CVE-2026-121545 Details
Description
Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.
A missing authentication vulnerability has been identified in Dreeve versions prior to 5.8.0, specifically within the StravaWebhookRequestHandler's event handling method. This vulnerability allows unauthenticated attackers to forge Strava webhook events and send them to the webhook URL without the required signature, verification token, or owner ID checks. Attackers can exploit this by sending fake delete events for known public Strava activities, leading to the permanent deletion of those activities and their associated data streams from the victim's Dreeve account.
Users can update to Dreeve version 5.8.1 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dreeveapp/dreeve/issues/2935 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/dreeveapp/dreeve | [email protected] | Vendor |
| https://github.com/dreeveapp/dreeve/blob/v5.7.0/src/Console/Strava/ProcessStravaWebhooksConsoleCommand.php | [email protected] | Source CodeVendor |
| https://github.com/dreeveapp/dreeve/blob/v5.7.0/src/Controller/Strava/StravaWebhookRequestHandler.php#L64-L80 | [email protected] | Source CodeVendor |
| https://github.com/dreeveapp/dreeve/commit/1e88f7664a95ecbffd299195f4730a60fcd3181a | [email protected] | Source CodeVendor |
| https://github.com/dreeveapp/dreeve/issues/2935 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/dreeveapp/dreeve/pull/2936 | [email protected] | Issue TrackingVendor |
| https://www.vulncheck.com/advisories/dreeve-before-5.8.0-missing-authentication-in-strava-webhook-post-handler | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Dreeve | >= 0, < 5.8.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |