CVE-2026-121545: Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler

Published Nov 3, 2026

Updated

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or ownerid checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.

Event History

Nov 3, 2026

CVE Published

via MITRE·03:17 PM

Data Sourced

via MITRE·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Dreeve versions before 5.8.0 are affected if their Strava webhook URL is reachable by an attacker. The affected handler accepts webhook POST requests without validating a signature, verify token, or owner_id.

What does an attacker need to exploit this?

An attacker does not need authentication or user interaction. They need the webhook URL and a known public Strava activity ID, which can be used in a forged delete event.

What is the impact of a successful attack?

Forged delete events can permanently delete imported activities and their associated streams. The provided information describes integrity and availability impact, not disclosure of data.

How can administrators tell whether they may have been affected?

Review webhook request and application logs for delete events submitted to the Strava webhook endpoint, especially events involving public activity IDs that cannot be tied to legitimate Strava webhook activity. Check whether imported activities and streams were unexpectedly removed.

CVE-2026-121545: Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What is the impact of a successful attack?

How can administrators tell whether they may have been affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What is the impact of a successful attack?

How can administrators tell whether they may have been affected?