CVE-2026-121545

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or ownerid checks. Attackers can send forged delete events with a known public Strav...