CVE-2026-121545— Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler

Quick assessment

Affected

robiningelbrecht dreeve

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Dreeve 5.8.0 之前的版本在中存在身份验证缺失漏洞。该漏洞允许未认证的攻击者在缺少签名、验证令牌（verify-token）或所有者 ID（owner_id）检查的情况下，伪造 Strava Webhook 事件。攻击者可以向 Webhook URL 发送包含已知公开 Strava 活动 ID 的伪造删除事件，从而导致已导入的活动及其数据流被永久删除。

CVSS 6.5 · Medium Updated Nov 03, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
robiningelbrecht	dreeve	`< 5.8.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler

Source: CVE Program / CVE List V5

Vulnerability Description

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

对数据真实性的验证不充分

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
robiningelbrecht	dreeve	0 ~ 5.8.0	-

II. Public POCs for CVE-2026-121545

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121545

请登录查看更多情报信息。

Other References for CVE-2026-121545 (7)

https://github.com/dreeveapp/dreeve/blob/v5.7.0/src/Console/Strava/ProcessStravaWebhooksConsoleCommand.php technical-description
https://github.com/dreeveapp/dreeve/pull/2936 technical-description patch issue-tracking
https://github.com/dreeveapp/dreeve product
https://github.com/dreeveapp/dreeve/blob/v5.7.0/src/Controller/Strava/StravaWebhookRequestHandler.php#L64-L80 technical-description
https://github.com/dreeveapp/dreeve/commit/1e88f7664a95ecbffd299195f4730a60fcd3181a patch
https://github.com/dreeveapp/dreeve/issues/2935 issue-tracking
https://www.vulncheck.com/advisories/dreeve-before-5.8.0-missing-authentication-in-strava-webhook-post-handler third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121545

IV. Related Vulnerabilities

Same weakness: CWE-345