Revive Adserver EUVD-2026-38510

Exploitation requires a valid low-privileged authenticated account on the target Revive Adserver instance, confirmed by CVSS PR:L. The attacker must share the instance with at least one other advertiser or manager whose campaign IDs they wish to target - single-tenant deployments with only trusted users are not at meaningful risk. The vulnerable endpoint campaign-trackers.php must be reachable over the network (AV:N); no special non-default configuration is required beyond the attacker possessing any valid low-privileged session. Exploitation is bounded by the credential requirement: unauthenticated attackers cannot exploit this flaw. The attack complexity is low (AC:L) - no race condition, timing dependency, or complex setup is needed once credentials are obtained.

The CVSS 3.0 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N accurately characterizes the constrained impact. The attack is network-accessible and requires no user interaction, but exploitation is gated behind a valid low-privileged account (PR:L). Impact is limited exclusively to integrity - no confidentiality exposure and no availability disruption. This CVE is not listed in CISA KEV, confirming no verified active exploitation. No EPSS score was provided in the source data, preventing quantitative probability comparison. The real-world risk is predominantly relevant to multi-tenant or shared Revive Adserver deployments where multiple competing advertisers or independent managers share a single instance; single-tenant deployments where all accounts are trusted present negligible risk. The primary harm is pollution of conversion attribution reporting and potential unauthorized insertion of tracking pixels into a victim campaign, which carries business and billing implications rather than security data breach risk.

An attacker with a valid low-privileged advertiser account on a shared Revive Adserver instance enumerates campaign IDs belonging to other managers - potentially through ad delivery responses or sequential ID probing - then submits a crafted POST request to campaign-trackers.php specifying a foreign campaign ID alongside their own tracker ID. Because the server performs no ownership check, the request succeeds, linking the attacker's tracker to the victim's campaign and corrupting the victim's conversion attribution data or injecting an unauthorized tracking pixel.