What’s Vulnerable › Vulnerabilities
CVE-2026-50739
- Severity: medium (CVSS 4.3 v3.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-26 · updated 2026-10-25
- Weakness: CWE-284
Description
A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the `tracker-campaigns.php` script in Revive Adserver 6.0.7 and earlier. As a result, a low‑privileged user could link their trackers to campaigns owned by other managers on the same instance, leading to inconsistent ownership relationships.
Affected products
- Revive Adserver: before 6.0.8 — fixed in 6.0.8
How to fix
Upgrade to a fixed version: Revive Adserver 6.0.8. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-50739 or the next vulnerability affects your stack