CVE-2026-121545

MediumCVSS 6.5/10Last modified Nov 7, 2026

Description

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
robiningelbrecht	dreeve	< 5.8.0

References

Timeline

Published: Nov 3, 2026
Last modified: Nov 7, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1215465.9ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirec CVE-2026-1215472.2Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by c CVE-2026-1215487.8Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafte CVE-2026-1215494.4nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite f CVE-2026-121556.5IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigge CVE-2026-1215503.3nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an ex CVE-2026-1215515.4PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by CVE-2026-1215524.3Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows auth CVE-2026-1215534.8Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ow CVE-2026-1215545.9cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts be CVE-2026-1215557.5Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /a CVE-2026-1215568.3FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users