Threat database

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.

CVE-2026-102923 is a server-side request forgery (SSRF) vulnerability in CodeWithCJ SparkyFitness, a self-hosted AI-powered health and fitness tracker. Versions prior to 1.6.0 improperly validate custom AI service URLs set by authenticated users, allowing crafted outbound POST requests with controlled bearer tokens. This can enable probing of internal services and disclosure of AI system prompts. The vulnerability is fixed in version 1.6.0.

CVE-2026-92263 is an OS command injection vulnerability in CodeWithCJ SparkyFitness, a self-hosted AI-powered health and fitness tracker. Versions prior to 1.6.0 have a flaw in the api/admin/backup/restore endpoint where an authenticated global administrator can upload a restore archive with a crafted filename containing shell metacharacters. This leads to arbitrary command execution with the server process privileges. The issue is fixed in version 1.6.0.

CVE-2025-65368 is a medium severity Cross Site Scripting (XSS) vulnerability affecting SparkyFitness version 0.15.8.2. The flaw arises from improper sanitization of user input and outputs generated by large language models (LLMs), allowing attackers to inject malicious scripts. Exploitation requires user interaction but no authentication, and can lead to partial compromise of confidentiality and integrity, though availability is not impacted. This vulnerability has a CVSS score of 6.1, reflecting its moderate risk level. No known exploits are currently reported in the wild, and no patches have been published yet. European organizations using SparkyFitness, especially those in countries with high adoption of fitness and wellness software, should be vigilant.