CVE-2026-113612

Name of the Vulnerable Software and Affected Versions SparkyFitness versions prior to 0.17.0

Description An authorization flaw allows authenticated users to delete food variants belonging to other users. This is possible via the 'DELETE /api/foods/food-variants/:id' endpoint by utilizing variant IDs obtained from public food read endpoints to remove serving and nutrition variants of publicly shared foods.

Recommendations Update SparkyFitness to version 0.17.0 or later. Restrict access to the 'DELETE /api/foods/food-variants/:id' endpoint to prevent unauthorized deletions.