{"id":"CVE-2026-121545","title":"Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler","summary":"Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Atta…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-345"],"vendor":"robiningelbrecht","product":"dreeve","affected":["dreeve < 5.8.0"],"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T15:17:05.929Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121545","references":[{"url":"https://github.com/dreeveapp/dreeve/issues/2935","label":"GitHub Issue #2935"},{"url":"https://github.com/dreeveapp/dreeve"},{"url":"https://github.com/dreeveapp/dreeve/commit/1e88f7664a95ecbffd299195f4730a60fcd3181a","label":"Fix commit"},{"url":"https://github.com/dreeveapp/dreeve/blob/v5.7.0/src/Controller/Strava/StravaWebhookRequestHandler.php#L64-L80"},{"url":"https://github.com/dreeveapp/dreeve/blob/v5.7.0/src/Console/Strava/ProcessStravaWebhooksConsoleCommand.php"},{"url":"https://github.com/dreeveapp/dreeve/pull/2936"},{"url":"https://www.vulncheck.com/advisories/dreeve-before-5.8.0-missing-authentication-in-strava-webhook-post-handler","label":"VulnCheck Advisory: Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler"}],"tags":["cve.org"],"epss":0.00208,"epssPercentile":0.11024,"ingestedAt":"2026-11-05T19:30:42.977Z","slug":"CVE-2026-121545","body":"## Overview\n\nDreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.\n\n## Affected\n\n- `dreeve < 5.8.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}