Dreeve versions before 5.8.0 have a vulnerability in the StravaWebhookRequestHandler::handleEvent function that lacks proper authentication checks. This allows unauthenticated attackers to forge Strava webhook events without verifying signatures, tokens, or owner IDs. Exploitation can lead to attackers sending forged delete events with known public Strava activity IDs to the webhook URL, resulting in permanent deletion of imported activities and their associated data streams.