Live › vulnerability › CVE-2026-113612
Go to dashboardSparkyFitness versions before 0.17.0 let any logged-in user delete food variants owned by other users through the DELETE /api/foods/food-variants/:id endpoint. An attacker can take variant IDs from public food read endpoints and remove serving and nutrition data from publicly shared foods.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted or shared SparkyFitness instances below 0.17.0 with multiple user accounts are exposed, because any authenticated user can reach the delete endpoint for food variants they do not own. Single-user instances, where only the owner has an account, carry little risk from other users. Instances already on 0.17.0 or later are not affected.
No product ranges from the sources yet.
0.17.0DELETE /api/foods/food-variants/:id handler and confirm it checks ownership before deleting0.17.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.
This page as .md · .json · in your agent: get_signal("CVE-2026-113612")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.