CVE-2026-121545
Deferred Deferred - Pending Action

Missing Authentication in Dreeve Strava Webhook Handling

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121545
EUVD
EUVD-2026-115890

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
robiningelbrecht dreeve 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Dreeve versions before 5.8.0 and involves a missing authentication flaw in the Strava webhook handler. Unauthenticated attackers can forge Strava webhook events without proper verification like signatures or tokens. By sending a malicious delete event with a known public Strava activity ID, they can permanently delete imported activities and their associated data streams from the system.

Detection Guidance

Check if your dreeve instance is running a version before 5.8.0 by running: curl -s https://your-dreeve-instance.com/version | grep -E '5\.[0-7]\.'

Impact Analysis

If you use Dreeve with Strava webhook integration enabled, an attacker could delete your imported activities and their GPS routes, heart-rate streams, and other data. They could also force unnecessary refetching of activities, consuming your Strava API rate limits. This could disrupt your fitness tracking and data analysis.

Mitigation Strategies
  • Upgrade dreeve to version 5.8.0 or later immediately to address the missing authentication flaw.
  • Disable Strava webhook integration if not essential until the upgrade is completed.
  • Review webhook logs for suspicious POST requests to /strava/webhook with delete events.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121545. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...