2.8 KiB
sparkyfitness — triage (group C, 2026-10-27)
Pins: codewithcj/sparkyfitness_server:v0.17.3, codewithcj/sparkyfitness:v0.17.3 (+ postgres:18-alpine). setup_gate + signup_block (/api/auth/sign-up) + SPARKY_FITNESS_DISABLE_SIGNUP after setup. BETTER_AUTH_SECRET: generated per install (generate: "hex:32", data_key, locked). Register: R-785 (P3, walk 0.17 -> 1.x after R-784); R-784 licence (decision 65: keep offered, ask author).
Notices (3, same on both images)
- GHSA-v883-jx9h-qf29 (medium): NOT-A-FINDING — only an install that kept the .env.example placeholder secret is exposed; our template generates a random BETTER_AUTH_SECRET per install. (Upstream fix: v1.7.3 "refuse to start with .env template placeholder secrets" #2617.)
- GHSA-cmmf-53wf-r5gv (low): REAL (
>= 0.17.3, <= 1.6.5, patched "None" — advisory page re-read 2026-10-27). Pregnancy photos served from the public /uploads static mount; no login needed but the attacker must already hold the full URL (user/pregnancy UUIDs + timestamp). - GHSA-p8cf-g8rv-gvrq (medium): REAL (
>= 0.15.8.1, <= 1.6.5, patched "None"). Needs an account + victim's UUID + victim's configured Withings client => household accounts only. Worst real: medium.
Fix
No fixed version named. Releases after v0.17.3 exist (v1.6.0..v1.9.0, Docker Hub tags v1.9.0 on both images), but none of their notes (v1.6.0..v1.9.0 read, grep for withings/upload/pregnancy/GHSA/security) names either fix; the advisory ranges stop at 1.6.5 only because that was the version tested. Unsure whether 1.9.0 fixes them. If moved anyway (R-785): TARGET v1.9.0 for both images; same main NO (0 -> 1). Breaking: v1.6.0 unified versioning, MCP decommissioned; v1.6.1 Postgres upgrade mandated (we already run 18); v1.7.0 BREAKING ALLOW_PRIVATE_NETWORK_FOOD_PROVIDERS for private Tandoor/Mealie; v1.7.2 BREAKING env vars removed (moved to admin settings), mandatory list reduced; v1.9.0 adaptive-calorie behaviour change. Lane: NO_FIX (cmmf, p8cf). BIG_STEP stays R-785.
NO_FIX options
cmmf — blocks it: URL unguessable; pregnancy tracking is a mobile-app feature. (A) do nothing, record: cost 0; if nothing, a leaked photo URL opens that one photo without login. (B) traefik rule refusing /uploads/pregnancy and /api/uploads/pregnancy: cost a template change + walk, and it also breaks photo display for the owner. p8cf — blocks it: setup gate + sign-up closed => only household members; needs a configured Withings integration. (A) do nothing, watch upstream: if nothing, a household member could overwrite another member's Withings link (data integrity, trusted insiders). (B) walk to v1.9.0 under R-785 and test the Withings callback: cost = the BIG_STEP walk; unsure it is fixed.
Classifier note
v883: when an advisory is about a default/placeholder secret, check the template's generate: for that env var — sparky generates BETTER_AUTH_SECRET.