Dreeve
Monthly
Remote attackers can forge Strava webhook events against Dreeve before 5.8.0 and cause permanent deletion of imported Strava activities and their streams. The StravaWebhookRequestHandler::handleEvent path does not verify the signature, verify-token, or owner_id, so a crafted DELETE event carrying a known public Strava activity id is accepted when the instance has imported that activity and its webhook endpoint is reachable. The assessed impact is limited to integrity and availability of imported activity data, with no confidentiality exposure or code execution, and no public exploit was identified at the time of analysis; this is a genuine but moderate-priority issue rather than an emergency.
Remote attackers can forge Strava webhook events against Dreeve before 5.8.0 and cause permanent deletion of imported Strava activities and their streams. The StravaWebhookRequestHandler::handleEvent path does not verify the signature, verify-token, or owner_id, so a crafted DELETE event carrying a known public Strava activity id is accepted when the instance has imported that activity and its webhook endpoint is reachable. The assessed impact is limited to integrity and availability of imported activity data, with no confidentiality exposure or code execution, and no public exploit was identified at the time of analysis; this is a genuine but moderate-priority issue rather than an emergency.