CVE-2026-113612
MediumCVSS 5.4Summary
SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.
Risk Assessment
An attacker can destroy other users' food data, causing information loss and application disruption. This can undermine trust in the system's data integrity.
Recommendation
Update SparkyFitness to version 0.17.0 or later. Implement authorization checks on the food variant deletion endpoint.
Other vulnerabilities in SparkyFitness
See all- CVE-2026-92263High
In SparkyFitness, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator can upload a restore archive with a crafted filename containing shell metacharacters, allowing execution of arbitrary OS commands with server process privileges.
- CVE-2026-102923Medium
In SparkyFitness prior to 1.6.0, chatService.ts and labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user can save a custom AI service URL and invoke an affected AI flow, triggering an outbound request with a controlled bearer value.
Original NVD description (English source)
SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS