PT-2026-52647 · Revive · Andserver

Aszh + 3 · Publicado 2026-06-26 · Atualizado 2026-06-26 · CVE-2026-50739

Mitre

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the tracker-campaigns.php script in Revive Adserver 6.0.7 and earlier. As a result, a low‑privileged user could link their trackers to campaigns owned by other managers on the same instance, leading to inconsistent ownership relationships.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-50739

Produtos afetados

Andserver

Referências · 1

• https://hackerone.com/reports/3780709 · Nota