Threats tagged 'ghsa-h9gp-qv79-4jmg'

VitaFit cloud API versions before 2026-10-30 have an insecure direct object reference (IDOR) vulnerability. Authenticated attackers can access other users' data by manipulating user_id or profile_id parameters in certain API endpoints. This allows unauthorized reading of email addresses, profiles, body-composition reports, and measurement histories. The vulnerability is combined with an account-enumeration weakness, enabling large-scale data access.