PT-2026-52647 · Unknown · Revive Adserver

Aszh + 3 · Published 2026-06-26 · Updated 2026-06-26 · CVE-2026-50739

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 6.0.8

Description An ownership validation bypass exists in the reverse operation of linking campaigns and trackers via the tracker-campaigns.php script. This flaw allows a low-privileged user to link their trackers to campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships.

Recommendations Update to version 6.0.8 or later. Restrict access to the tracker-campaigns.php script to authorized administrators until the update is applied.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-50739

Affected Products

Revive Adserver

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-50739 · Security Note
• https://twitter.com/VulmonFeeds/status/2070391029803499640 · Twitter Post
• https://hackerone.com/reports/3780709 · Note