CVE-2026-34913

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 6.0.7

Description A missing access control check in the 'campaign-trackers.php' script allows a low-privileged user to link their trackers to campaigns owned by other managers on the same instance. This leads to inconsistent ownership relationships. The issue occurs because the system fails to validate that campaigns are only linked to trackers owned by the same advertiser.

Recommendations Update to version 6.0.7 or later to ensure ownership validation is active.