VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Jun 26, 2026· Updated Jun 29, 2026

CVE-2026-50739

CVE-2026-50739

Description

A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the tracker-campaigns.php script in Revive Adserver 6.0.7 and earlier. As a result, a low‑privileged user could link their trackers to campaigns owned by other managers on the same instance, leading to inconsistent ownership relationships.

Affected products

2
  • Revive Adserver/Adserver2 versions
    cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*range: <6.0.8
    • (no CPE)range: <=6.0.7

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.