SparkyFitness vulnerabilities

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.

In SparkyFitness, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator can upload a restore archive with a crafted filename containing shell metacharacters, allowing execution of arbitrary OS commands with server process privileges.

In SparkyFitness prior to 1.6.0, chatService.ts and labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user can save a custom AI service URL and invoke an affected AI flow, triggering an outbound request with a controlled bearer value.