PT-2026-36689 · Eyeo · Adblock Plus

Drxyj · Published 2026-05-03 · Updated 2026-05-03 · CVE-2026-7686

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions eyeo Adblock Plus versions prior to 4.36.3

Description Improper access controls exist in the Legacy Premium Activation component within the postMessage() function of the premium.preload.js file. This allows remote exploitation through manipulation, though the affected code path is part of a deprecated activation flow. The licensing server issues short-lived trial licenses (approximately 24 hours) for any submitted userId, which expire upon the next validation if no valid subscription is found.

Recommendations Upgrade the affected component to a version later than 4.36.2.

Exploit

Fix

Incorrect Privilege Assignment

Improper Access Control

Weakness Enumeration

CWE-266

CWE-284

Related Identifiers

CVE-2026-7686

Affected Products

Adblock Plus

References · 9

• 🔥 https://github.com/xryj920/CVE/blob/main/adblock_plus_CVE_report.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-7686 · Security Note
• https://adblockplus.org/en/download · Patch
• https://twitter.com/VulmonFeeds/status/2050858195166335447 · Twitter Post
• https://t.me/cveNotify/161917 · Telegram Post
• https://t.me/CVEtracker/52566 · Telegram Post
• https://vuldb.com/submit/793551 · Note
• https://vuldb.com/vuln/360856/cti · Note
• https://vuldb.com/vuln/360856 · Note