SparkyFitness vulnerabilities
CVEs whose affected-version data names the SparkyFitness package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-113612Medium· 5.4PoCSparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint
SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from publ…
CVE-2026-102923Medium· 5.4SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in…
CVE-2026-92263High· 7.2PoCSparkyFitness: Authenticated OS command injection (host RCE) via backup-restore filename in POST /api/admin/backup/restore
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploa…