What is the CVSS score of CVE-2026-34913?

CVE-2026-34913 has a CVSS 3.0 base score of 4.3 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Revive Adserver CVE-2026-34913

EUVD-2026-38510 MEDIUM

Improper Access Control (CWE-284)

2026-06-23 hackerone

GHSA-r7wr-vr9q-m8f9

PHP Authentication Bypass Adserver Revive

4.3

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint requires a valid low-privileged session (PR:L); only integrity is impacted via unauthorized tracker-campaign association; no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 17:10 vuln.today

DescriptionCVE.org

A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to link their trackers to campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that campaigns can only be linked to trackers owned by the same advertiser.

AnalysisAI

Improper access control in Revive Adserver 6.0.6 and earlier allows an authenticated low-privileged user to link their own trackers to advertising campaigns owned by other managers on the same instance via campaign-trackers.php. The flaw enables unauthorized manipulation of campaign-tracker ownership relationships, corrupting attribution data and potentially introducing unauthorized tracking into other managers' campaigns. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Technical ContextAI

Revive Adserver is an open-source PHP-based ad serving platform used to manage and deliver online advertising campaigns. The vulnerability resides in campaign-trackers.php, the script responsible for linking conversion trackers to campaigns. The root cause is CWE-284 (Improper Access Control): the application correctly enforces authentication (a valid session with PR:L privileges is required) but entirely omits authorization logic to verify that the tracker being linked belongs to the same advertiser as the target campaign. This is a classic object-level authorization failure - the server trusts attacker-supplied campaign and tracker IDs without validating their ownership relationship. The CPE cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:* confirms all versions through 6.0.6 are affected. The fix, per the vulnerability description, adds ownership validation to enforce that campaigns can only be associated with trackers owned by the same advertiser.

RemediationAI

The vendor has addressed this vulnerability by adding ownership validation to campaign-trackers.php to ensure campaigns can only be linked to trackers owned by the same advertiser. Users should upgrade to the first Revive Adserver release that incorporates this fix; however, an exact patched version number (e.g., 6.0.7) is not independently confirmed from the available reference data - consult the HackerOne report at https://hackerone.com/reports/3650582 and the official Revive Adserver release notes for the confirmed fixed version. If an immediate upgrade is not feasible, restrict HTTP access to campaign-trackers.php at the web server layer (e.g., via Apache Location directives or nginx location blocks) for all non-administrative roles; note this will prevent low-privileged users from performing any tracker-campaign linking, which may be a legitimate workflow requiring coordination with those users. Additionally, auditing existing campaign-tracker associations for anomalous cross-advertiser links is advisable to identify any prior exploitation.