SparkyFitness versions prior to 0.17.0 contain a missing authorization check on the DELETE /api/foods/food-variants/:id endpoint. Authenticated users can delete food variant records belonging to other users. By harvesting variant IDs through publicly readable food endpoints, an attacker can remove serving and nutrition data from foods that the victim has shared, causing loss of data and potentially impacting dietary tracking functionality.

The vulnerability affects all installations of SparkyFitness running any version before 0.17.0, as identified in the vendor CodeWithCJ. No specific sub‑versions are listed, so all releases in that range are impacted.

With a CVSS score of 5.3 the vulnerability is classified as medium severity. No EPSS value is provided, and the issue is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. The attack requires authenticated access and knowledge of variant IDs, which can be obtained from public food read endpoints, indicating that the attack vector is likely internal users or compromised accounts with legitimate credentials.