Threats tagged 'ghsa-vfgc-8vj5-8w5w'

VitaFit cloud API versions before 2026-10-30 have an improper access control vulnerability in the AWS role issued by Cognito. This flaw allows authenticated users to perform s3:PutObject operations on the entire shared S3 bucket rather than being restricted to their own folders. Exploitation enables attackers to overwrite other users' objects, destroying original content without triggering deletion protections.