Missing Authorization in SparkyFitness Lets Users Delete Food Variants

Executive Summary

This vulnerability is a missing authorization flaw in SparkyFitness before version 0.17.0. It allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can exploit variant IDs from public food read endpoints to delete serving and nutrition variants of publicly shared foods, destroying victims' data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check SparkyFitness server logs for unauthorized DELETE requests to /api/foods/food-variants/:id endpoints. Monitor for repeated deletion attempts or errors indicating missing ownership checks. Use network traffic analysis tools to inspect HTTP DELETE requests targeting food variant endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to data loss for users who share food variants publicly. Attackers can delete variants of shared foods, affecting meal plans and food tracking for multiple users. It compromises data integrity and availability but does not impact confidentiality.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data deletion of user information, potentially violating GDPR's integrity principle (Article 5) and HIPAA's integrity and availability requirements. Unauthorized deletions may constitute data breaches under GDPR if personal data is destroyed without consent.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to SparkyFitness version 0.17.0 or later. If upgrading is not possible, implement ownership validation in the deleteFoodVariant function and restrict RLS policies to prevent unauthorized deletions. Temporarily disable public food variant deletion endpoints if feasible.

Useful 0 Not Useful 0