Vulnerabilities

TI-2026-76941 CVE-2026-113612 · GHSA-p92j-4g3m-hx3x

SparkyFitness missing authorization lets users delete others' food variants

MEDIUM 57

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00389 Published 2026-10-20 Fixed in 0.17.0 CWE-862

TI-2026-75335 CVE-2026-102923

Server-side request forgery in SparkyFitness AI service settings

MEDIUM 58

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00265 Published 2026-10-16 Fixed in 1.6.0 CWE-918

TI-2026-75359 CVE-2026-92263

OS command injection in SparkyFitness backup restore

HIGH 67

SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0045 Published 2026-10-16 Fixed in 1.6.0 CWE-78

TI-2025-40340 CVE-2025-65368 · GHSA-m77m-g5m4-wr4f

SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output.

MEDIUM 60

SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00251 Published 2026-01-15 No fix listed CWE-79

Vulnerabilities

Filters

SparkyFitness missing authorization lets users delete others' food variants

Server-side request forgery in SparkyFitness AI service settings

OS command injection in SparkyFitness backup restore

SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output.