CVE-2026-102923 Details
Description
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user saves a custom AI service URL and invokes an affected AI flow. The user can save a custom AI service URL and trigger an outbound request. Successful exploitation can send server-side POST requests with a controlled bearer value, probe internal services, and disclose the AI system prompt. This issue is fixed in version 1.6.0.
A server-side request forgery (SSRF) vulnerability exists in SparkyFitness versions prior to 1.6.0. The issue arises because the application does not validate URLs provided in custom AI service settings. An authenticated user can save a malicious URL and trigger an outbound request, allowing them to send POST requests with a controlled authorization bearer token, probe internal services, and access the AI system prompt.
Users can upgrade to SparkyFitness version 1.6.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-rmxj-43xh-mcm3 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/CodeWithCJ/SparkyFitness/commit/0b43a37003a3fbedf4e38058130460fd4707fe29 | [email protected] | Source CodeVendor |
| https://github.com/CodeWithCJ/SparkyFitness/releases/tag/v1.6.0 | [email protected] | Release NotesVendor |
| https://github.com/CodeWithCJ/SparkyFitness/security/advisories/GHSA-rmxj-43xh-mcm3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CodeWithCJ SparkyFitness | <= 0.16.5.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |