CVE-2026-113612 — SparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint
SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-va…
Published: 2026-10-20 · CVSS: 5.3 · CVSS 4.0
SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7