CVE-2026-50739
Analyzed Analyzed - Analysis Complete

Revive Adserver Campaign-Tracker Ownership Bypass

Publication date: 2026-06-26

Last updated on: 2026-06-29

Assigner: HackerOne

Description
A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the `tracker-campaigns.php` script in Revive Adserver 6.0.7 and earlier. As a result, a low‑privileged user could link their trackers to campaigns owned by other managers on the same instance, leading to inconsistent ownership relationships.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-26
Last Modified
2026-06-29
Generated
2026-07-17
AI Q&A
2026-06-26
EPSS Evaluated
2026-07-16
NVD
CVE-2026-50739
EUVD
EUVD-2026-39601

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
revive-adserver revive_adserver to 6.0.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a bypass related to CVE-2026-34913 in Revive Adserver version 6.0.7 and earlier. It occurs because proper ownership validation was not applied during the reverse operation of linking campaigns and trackers via the tracker-campaigns.php script. As a result, a low-privileged user can link their trackers to campaigns owned by other managers within the same instance.

This leads to inconsistent ownership relationships between trackers and campaigns.

Impact Analysis

The impact of this vulnerability is that a low-privileged user can manipulate the linkage between trackers and campaigns owned by other users. This can cause confusion or mismanagement of campaign data due to inconsistent ownership relationships.

However, the vulnerability does not affect confidentiality or availability, as indicated by the CVSS score which shows no impact on confidentiality or availability, only a low impact on integrity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50739. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart