Threats tagged 'ghsa-jr4h-546g-564w'

VitaFit cloud API versions before 2026-10-30 have a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials via the POST /front/user/s3/token/ endpoint. These credentials are improperly scoped, enabling attackers to list the shared storage bucket and read or overwrite files belonging to other users. This results in unauthorized cross-user data access and manipulation.