Description
SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
CodeWithCJ SparkyFitness
Default version status: unaffected
0 to < 0.17.0affected
pkg:github/CodeWithCJ/SparkyFitnessReferences
- https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-qph8-6xrr-7xjw ↗
- https://github.com/CodeWithCJ/SparkyFitness/commit/79215eb4d6dda12262e1bb15b76dceb0e37f6fa1 ↗
- https://github.com/CodeWithCJ/SparkyFitness/releases/tag/v0.17.0 ↗
- https://github.com/CodeWithCJ/SparkyFitness/blob/v0.16.9/SparkyFitnessServer/services/foodCoreService.ts#L479-L498 ↗
- https://www.vulncheck.com/advisories/sparkyfitness-before-0.17.0-missing-authorization-via-food-variants-delete-endpoint ↗