Missing Authorization in SparkyFitness Allows Data Deletion by Authenticated Users

CVE-2026-113612

What is CVE-2026-113612?

SparkyFitness versions prior to 0.17.0 exhibit a missing authorization vulnerability that can be exploited by authenticated users. This flaw allows users to delete food variant data belonging to other users through the unrestricted DELETE /api/foods/food-variants/:id endpoint. Attackers can easily retrieve variant IDs from publicly accessible food read endpoints, enabling them to maliciously remove serving and nutrition variants of shared foods, thereby compromising the integrity of victims' data.

References