Live › vulnerability › CVE-2026-121545
Dreeve before 5.8.0 accepts Strava webhook events without checking the signature, verify token, or owner id. An unauthenticated attacker can send forged delete events for a known public Strava activity id and permanently remove imported activities and their streams.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Teams running Dreeve with the Strava webhook endpoint exposed to the internet are affected. Deployments that do not expose the Strava webhook URL, or that run a version at or above 5.8.0, can skip it. unknown whether the sources list other preconditions.
No product ranges from the sources yet.
5.8.0StravaWebhookRequestHandler class and confirm whether handleEvent verifies a signature, verify token, or owner_id5.8.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.
This page as .md · .json · in your agent: get_signal("CVE-2026-121545")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.