Threats tagged 'ghsa-f537-2pqg-8rvm'

VitaFit cloud API versions before 2026-10-30 have an excessive data exposure vulnerability in the GET /front/relation/search/ endpoint. Authenticated users can exploit this flaw to retrieve personally identifiable information (PII) and health-related profile data of other users. The exposed data includes identifiers, emails, birthdays, gender, height, weight goals, phone numbers, and Firebase UIDs. This vulnerability allows attackers to enumerate the user directory by using overlapping alphanumeric search terms.