CVE-2026-113612 CodeWithCJ CVE debrief

Who should care

Defenders responsible for SparkyFitness deployments should verify their version and upgrade to 0.17.0 or later if vulnerable. They should also review and restrict access to the affected endpoint and monitor for suspicious activity.

Why it matters

CVE-2026-113612 is a medium-severity vulnerability in SparkyFitness that allows authenticated users to delete other users' food variants. Defenders should verify their version, restrict access to the affected endpoint, and monitor for suspicious activity. Upgrading to version 0.17.0 or later is recommended.

• Data destruction through unauthorized food variant deletion
• Potential disruption to users' nutrition and serving data
• Need for verification of affected systems and versions
• Priority for upgrading to version 0.17.0 or later

Technical summary

The vulnerability exists in the DELETE /api/foods/food-variants/:id endpoint of SparkyFitness before version 0.17.0. Authenticated users can delete other users' food variants, potentially leading to data destruction. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. This issue allows attackers to use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, which could result in the destruction of victims' data. Defenders should verify their SparkyFitness version and upgrade to 0.17.0 or later if vulnerable. They should also review and restrict access to the affected endpoint and monitor for suspicious activity related to food  

Defensive priority

Medium priority for defenders to verify and remediate, as it requires authentication and specific endpoint access.

Recommended defensive actions

• Verify SparkyFitness version and upgrade to 0.17.0 or later if vulnerable
• Review and restrict access to the DELETE /api/foods/food-variants/:id endpoint
• Monitor for suspicious activity on food variant deletion
• Perform a thorough review of SparkyFitness deployments to identify potential exposure
• Implement compensating controls to limit the impact of unauthorized food variant deletion
• Conduct regular asset inventory checks to ensure all instances are updated and secure
• Track changes and updates to SparkyFitness versions and configurations

Evidence notes

The vulnerability is confirmed in SparkyFitness versions before 0.17.0. The CVE Program and NVD provide official records of the vulnerability. Vendor advisory and technical descriptions are available, but further verification is needed to determine the full scope of affected systems and potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.