A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to link their trackers to campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that campaigns can only be linked to trackers owned by the same advertiser.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
References
| Link | Providers |
|---|---|
| https://hackerone.com/reports/3650582 |
|
History
Tue, 23 Jun 2026 19:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Missing Access Control in Tracker‑Campaign Linking Allows Unauthorized Ownership Manipulation |
Tue, 23 Jun 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 23 Jun 2026 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to link their trackers to campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that campaigns can only be linked to trackers owned by the same advertiser. | |
| Weaknesses | CWE-284 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: hackerone
Published: 2026-06-23T16:14:38.661Z
Updated: 2026-06-23T17:23:05.997Z
Reserved: 2026-03-31T15:00:06.522Z
Link: CVE-2026-34913
Vulnrichment
Updated: 2026-06-23T17:23:03.209Z
NVD
No data.
Redhat
No data.