Read the docs
TI-2026-76941 Aliases CVE-2026-113612GHSA-p92j-4g3m-hx3x

SparkyFitness missing authorization lets users delete others' food variants

Priority MEDIUM 57CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

CodeWithCJ SparkyFitness from 0 before 0.17.0 has a missing authorization flaw (CWE-862) in the DELETE /api/foods/food-variants/:id endpoint. An authenticated user with low privileges can delete serving and nutrition variants belonging to other users, including variants of publicly shared foods, by using variant IDs from public food read endpoints. The CVSS 4.0 vector rates confidentiality impact as none and integrity and availability impact as low. The sources report no public exploit or CISA KEV listing.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00389 33rd percentileScored 2026-11-07
Fix Fixed SparkyFitness (CodeWithCJ): 0.17.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CodeWithCJSparkyFitnessbefore 0.17.00.17.0Patch availableCNA
  • SparkyFitness VendorCodeWithCJ Affected before 0.17.0 Fixed in 0.17.0 Patch available CNA

Remediation

Upgrade CodeWithCJ SparkyFitness to version 0.17.0 or later, which is the fixed version. The sources list no vendor advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA SparkyFitness (CodeWithCJ) Fixed in 0.17.0

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113612
  2. 2026-10-20 CISA SSVC decision points changed
  3. 2026-10-20 Priority changed: LOW → MEDIUM
  4. 2026-10-21 Alias added: GHSA-p92j-4g3m-hx3x

References

Patch 1

Advisory 1

Other 2

  • TI-2026-75359 OS command injection in SparkyFitness backup restore CVSS 3.1HIGH 7.2
  • TI-2025-40340 SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output. CVSS 3.1MEDIUM 6.1
  • TI-2026-75335 Server-side request forgery in SparkyFitness AI service settings CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences