CVE-2026-121545

MEDIUM 6.5

Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.

CWE	CWE-345
Vendor	robiningelbrecht
Product	dreeve
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for robiningelbrecht dreeve

Be the first to know when new medium vulnerabilities affecting robiningelbrecht dreeve are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Affected Versions

robiningelbrecht / dreeve

0 < 5.8.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/dreeveapp/dreeve/issues/2935 github.com: https://github.com/dreeveapp/dreeve github.com: https://github.com/dreeveapp/dreeve/commit/1e88f7664a95ecbffd299195f4730a60fcd3181a github.com: https://github.com/dreeveapp/dreeve/blob/v5.7.0/src/Controller/Strava/StravaWebhookRequestHandler.php#L64-L80 github.com: https://github.com/dreeveapp/dreeve/blob/v5.7.0/src/Console/Strava/ProcessStravaWebhooksConsoleCommand.php github.com: https://github.com/dreeveapp/dreeve/pull/2936 vulncheck.com: https://www.vulncheck.com/advisories/dreeve-before-5.8.0-missing-authentication-in-strava-webhook-post-handler

Credits

George Chen