What is the CVSS score of EUVD-2026-38501?

EUVD-2026-38501 has a CVSS 3.0 base score of 4.3 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Revive Adserver EUVD-2026-38501

| CVE-2026-34912 MEDIUM

Improper Access Control (CWE-284)

2026-06-23 hackerone

GHSA-6g73-hr73-wjqj

PHP Authentication Bypass Adserver Revive

4.3

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible endpoint, low complexity, requires authenticated low-privileged account; impact is integrity-only, limited to zone ownership relationship corruption.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 17:07 vuln.today

DescriptionCVE.org

A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and earlier, or via its API allows a low‑privileged user could link their zones to banners or campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that banners and campaigns can only be linked to zones managed by the same account.

AnalysisAI

Revive Adserver 6.0.6 and earlier fails to enforce ownership validation when linking banners or campaigns to ad zones via the zone-include.php script or the platform API, allowing any authenticated low-privileged user to associate their zones with advertising assets owned by other managers on the same installation. This breaks the intended multi-tenant ownership isolation, producing inconsistent cross-account zone-to-banner and zone-to-campaign relationships that disrupt legitimate advertiser operations. No public exploit has been identified and there is no CISA KEV listing; however, the low attack complexity and network accessibility via both the web interface and API make exploitation straightforward for any authenticated platform user.

Technical ContextAI

Revive Adserver is an open-source PHP-based ad serving platform designed for multi-tenant deployments where multiple advertiser accounts coexist on a single instance. The vulnerability resides in zone-include.php and the corresponding API endpoint responsible for linking ad zones to banners or campaigns. The root cause is CWE-284 (Improper Access Control): the server-side handler accepted zone-to-banner and zone-to-campaign linkage requests without verifying that the target banner or campaign belongs to the same manager account as the zone being modified. The CPE cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:* covers all versions through 6.0.6. The fix introduces ownership validation checks at these endpoints to enforce that banners and campaigns can only be linked to zones under the same account - a standard authorization guard that was entirely absent from these code paths.

RemediationAI

Upgrade Revive Adserver to the version that introduces ownership validation for zone-to-banner and zone-to-campaign linkage; the exact patched release number is not specified in the available references and should be verified against the HackerOne report at https://hackerone.com/reports/3650504 or the official Revive Adserver release notes. If immediate upgrade is not feasible, restrict access to zone-include.php and the API's zone-linking endpoints at the web server level (via Apache or nginx ACLs) so that only administrator-level accounts can invoke these endpoints - the trade-off is that non-admin users lose the ability to manage zone-to-creative linkage independently. For multi-tenant deployments where untrusted advertisers share the same instance, this compensating control is especially critical until a patch is applied. Single-account or internally-operated deployments face significantly lower risk.