{"id":"EM-20261105-HPES","url":"https://cyber.eventmonitor.net/incident/EM-20261105-HPES/vulnerability-cve-2026-54383/","type":"cve","title":"Vulnerability (CVE-2026-54383)","subtitle":"CVE-2026-54383","subject":"CVE-2026-54383","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-05T00:33:07.000Z","firstSignal":"2026-11-04T23:17:48.360Z","lastSignal":"2026-11-05T00:33:07.000Z","updated":"2026-11-05T02:06:24.577Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T00:33:07.000Z","why":"second independent source: C29 CIRCL Vulnerability-Lookup"},{"status":"Developing","at":"2026-11-05T00:33:07.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-04T23:17:48.360Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-05T00:33:07.000Z","what":"Born: second source, C29 CIRCL Vulnerability-Lookup. Page EM-20261105-HPES created."}],"stages":[{"name":"Disclosed","at":"2026-11-04T23:17:48.360Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-04T23:17:48.360Z","detail":"CVSS 7.1"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-04T23:17:48.360Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-54383 (CVSS 7.1)","text":"VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using overlapping alphanumeric search terms to harvest identifiers, emails, birthdays, gender, height, weight goals, phone numbers, and Firebase UIDs.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54383"},{"at":"2026-11-05T00:33:07.000Z","source":"C29","sourceName":"CIRCL Vulnerability-Lookup","role":"Database","severity":2,"title":"GHSA-f537-2pqg-8rvm / CVE-2026-54383","text":"VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using overl","url":"https://vulnerability.circl.lu/vuln/GHSA-f537-2pqg-8rvm"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-04T23:17:48.360","score":7.1,"severity":"HIGH","desc":"VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can enumerate the user directory using overl","product":"","seen":1793844384577},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}