---
id: "CVE-2026-121545"
kind: "vulnerability"
aliases: ["CVE-2026-121545"]
title: "Dreeve: forged Strava webhook events can delete imported activities"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dreeve", "package", "php", "self-hosted", "strava"]
not_affected_if: ["version-5.8.0-or-later", "webhook-not-exposed"]
published_at: "2026-11-03T16:17:26+00:00"
first_seen_at: "2026-11-03T16:21:43+00:00"
updated_at: "2026-11-03T16:23:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121545", "first_seen_at": "2026-11-03T16:21:43+00:00"}]
---

# Dreeve: forged Strava webhook events can delete imported activities

Dreeve before 5.8.0 accepts Strava webhook events without checking the signature, verify token, or owner id. An unauthenticated attacker can send forged delete events for a known public Strava activity id and permanently remove imported activities and their streams.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Dreeve version against `5.8.0`
- Look for the `StravaWebhookRequestHandler` class and confirm whether `handleEvent` verifies a signature, verify token, or owner_id

## Fix

- Dreeve: move to `5.8.0` or later

## Timeline

- 2026-11-03T16:21:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121545

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/dreeve-before-5.8.0-missing-authentication-in-strava-webhook-post-handler
- [fix] Patch: github.com https://github.com/dreeveapp/dreeve/commit/1e88f7664a95ecbffd299195f4730a60fcd3181a

## From the sources

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_