CVE-2026-34913

4.3 Moyenne

Publiée le 23/06/2026 à 19:16 · Modifiée le 23/06/2026 à 20:17 · Analyse NVD reportée · Source : support@hackerone.com

Description

A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to link their trackers to campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that campaigns can only be linked to trackers owned by the same advertiser.

Traduire en français

Produits concernés

Revive Adserver

Scores CVSS

Version	Score	Source	Vecteur
3.0	4.3 Moyenne	support@hackerone.com	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-284

Références

https://hackerone.com/reports/3650582

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories