What is the CVSS score of CVE-2026-34913?

CVE-2026-34913 has a CVSS 3.0 base score of 4.3 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Revive Adserver CVE-2026-34913

EUVD-2026-38510 MEDIUM

Improper Access Control (CWE-284)

2026-06-23 hackerone

GHSA-r7wr-vr9q-m8f9

PHP Authentication Bypass Adserver

4.3

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint requires a valid low-privileged session (PR:L); only integrity is impacted via unauthorized tracker-campaign association; no confidentiality or availability impact applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 17:10 vuln.today

DescriptionCVE.org

A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to link their trackers to campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that campaigns can only be linked to trackers owned by the same advertiser.

AnalysisAI

Improper access control in Revive Adserver 6.0.6 and earlier allows an authenticated low-privileged user to link their own trackers to advertising campaigns owned by other managers on the same instance via campaign-trackers.php. The flaw enables unauthorized manipulation of campaign-tracker ownership relationships, corrupting attribution data and potentially introducing unauthorized tracking into other managers' campaigns. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain valid low-privileged account on shared instance

Delivery

Enumerate target campaign IDs belonging to other managers

Exploit

Craft POST request to campaign-trackers.php with foreign campaign ID and own tracker ID

Execution

Server accepts request due to missing ownership check

Impact

Attacker tracker linked to victim campaign, corrupting attribution data

Access

Obtain valid low-privileged account on shared instance

Delivery

Enumerate target campaign IDs belonging to other managers

Exploit

Craft POST request to campaign-trackers.php with foreign campaign ID and own tracker ID

Execution

Server accepts request due to missing ownership check

Impact

Attacker tracker linked to victim campaign, corrupting attribution data

Vulnerability AssessmentAI

Exploitation	Exploitation requires a valid low-privileged authenticated account on the target Revive Adserver instance, confirmed by CVSS PR:L. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.0 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately characterizes the constrained impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker with a valid low-privileged advertiser account on a shared Revive Adserver instance enumerates campaign IDs belonging to other managers - potentially through ad delivery responses or sequential ID probing - then submits a crafted POST request to campaign-trackers.php specifying a foreign campaign ID alongside their own tracker ID. Because the server performs no ownership check, the request succeeds, linking the attacker's tracker to the victim's campaign and corrupting the victim's conversion attribution data or injecting an unauthorized tracking pixel.
Remediation	The vendor has addressed this vulnerability by adding ownership validation to campaign-trackers.php to ensure campaigns can only be linked to trackers owned by the same advertiser. … Detailed patch versions, workarounds, and compensating controls in full report.