What is the CVSS score of CVE-2026-34912?

CVE-2026-34912 has a CVSS 3.0 base score of 4.3 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Revive Adserver CVE-2026-34912

EUVD-2026-38501 MEDIUM

Improper Access Control (CWE-284)

2026-06-23 hackerone

GHSA-6g73-hr73-wjqj

PHP Authentication Bypass Adserver

4.3

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint, low complexity, requires authenticated low-privileged account; impact is integrity-only, limited to zone ownership relationship corruption.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 17:07 vuln.today

DescriptionCVE.org

A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and earlier, or via its API allows a low‑privileged user could link their zones to banners or campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that banners and campaigns can only be linked to zones managed by the same account.

AnalysisAI

Revive Adserver 6.0.6 and earlier fails to enforce ownership validation when linking banners or campaigns to ad zones via the zone-include.php script or the platform API, allowing any authenticated low-privileged user to associate their zones with advertising assets owned by other managers on the same installation. This breaks the intended multi-tenant ownership isolation, producing inconsistent cross-account zone-to-banner and zone-to-campaign relationships that disrupt legitimate advertiser operations. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate as low-privileged platform user

Delivery

Enumerate valid banner or campaign IDs on the instance

Exploit

Craft zone-link request with cross-account asset ID

Execution

Submit to zone-include.php or API without ownership check

Persist

Server persists unauthorized zone-to-banner relationship

Impact

Victim campaign delivery disrupted

Access

Authenticate as low-privileged platform user

Delivery

Enumerate valid banner or campaign IDs on the instance

Exploit

Craft zone-link request with cross-account asset ID

Execution

Submit to zone-include.php or API without ownership check

Persist

Server persists unauthorized zone-to-banner relationship

Impact

Victim campaign delivery disrupted

Vulnerability AssessmentAI

Exploitation	The attacker must hold a valid authenticated account on the target Revive Adserver instance with at least low-privileged zone management permissions (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.0 score of 4.3 (Medium) accurately reflects the constrained impact: network-accessible (AV:N), low complexity (AC:L), requiring a low-privileged account (PR:L), with integrity-only impact (I:L) and no confidentiality or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated low-privileged advertiser on a shared Revive Adserver instance enumerates valid banner or campaign IDs belonging to a competitor by observing existing ads or leveraging any ID disclosure in the interface, then submits a crafted HTTP request to zone-include.php or the equivalent API endpoint specifying their own zone ID alongside the victim's banner or campaign ID. The server, lacking an ownership check, accepts the linkage and begins serving the victim's creative assets from the attacker's zones, effectively hijacking the victim's campaign delivery. …
Remediation	Upgrade Revive Adserver to the version that introduces ownership validation for zone-to-banner and zone-to-campaign linkage; the exact patched release number is not specified in the available references and should be verified against the HackerOne report at https://hackerone.com/reports/3650504 or the official Revive Adserver release notes. … Detailed patch versions, workarounds, and compensating controls in full report.