Is CVE-2026-121545 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-121545?

CVE-2026-121545 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-121545

Description

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.