Dreeve EUVD-2026-115890

Exploitation requires that the target run Dreeve before 5.8.0 with its Strava webhook endpoint (StravaWebhookRequestHandler) network-reachable by the attacker, and that the instance has imported Strava activities. The attacker must know the public Strava activity id of an imported activity to target it for deletion. No authentication, credentials, user interaction, or non-default configuration is otherwise required - the handler simply omits signature, verify-token, and owner_id verification. The practical limiting factors are: the attacker needs a valid known (public) activity id that exists in the victim's imported data, and the instance's webhook URL must be externally accessible rather than firewalled or behind an unexposed deployment. Impact is confined to destruction of imported activity records and their streams; there is no confidentiality exposure or code execution.

This is a genuine but moderate-priority issue, not an inflated high-CVSS alarm. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms it is remotely reachable with no authentication, no user interaction, and low attack complexity - the webhook handler accepts forged events without signature, verify-token, or owner_id validation, so the barrier to triggering it is low. What caps the real-world risk is the impact profile: VC:N (no confidentiality loss), VI:L and VA:L (only limited integrity/availability impact, i.e. deletion of already-imported Strava activity data), with no scope change and no code execution. No EPSS score, KEV listing, or confirmed public exploit was provided in the input, so there is no signal of active or widespread exploitation; the vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with a real-but-not-urgent fix. The chief caveat is that exploitation is data-destructive and irreversible for affected instances, and the product is self-hosted, so the practical risk depends heavily on how exposed each instance's webhook endpoint is.

An attacker who can reach an internet-exposed Dreeve instance's Strava webhook URL crafts a POST that mimics a Strava 'delete' aspect event referencing a known public Strava activity id that the victim has imported. Because the handler performs no signature, verify-token, or owner_id check, Dreeve accepts the forged event and permanently deletes the imported activity and its streams. No public exploit code was identified at time of analysis, but the attack requires only an unauthenticated HTTP request and knowledge of a public activity id.