Threat database

SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.

CVE-2026-102923 is a server-side request forgery (SSRF) vulnerability in CodeWithCJ SparkyFitness, a self-hosted AI-powered health and fitness tracker. Versions prior to 1.6.0 improperly validate custom AI service URLs set by authenticated users, allowing crafted outbound POST requests with controlled bearer tokens. This can enable probing of internal services and disclosure of AI system prompts. The vulnerability is fixed in version 1.6.0.

CVE-2026-92263 is an OS command injection vulnerability in CodeWithCJ SparkyFitness, a self-hosted AI-powered health and fitness tracker. Versions prior to 1.6.0 have a flaw in the api/admin/backup/restore endpoint where an authenticated global administrator can upload a restore archive with a crafted filename containing shell metacharacters. This leads to arbitrary command execution with the server process privileges. The issue is fixed in version 1.6.0.