CVE-2026-21641: High severity Revive Adserver vulnerability
HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the tracker-delete.php script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-21641?
The severity of CVE-2026-21641 is rated as high due to the potential for unauthorized deletion of trackers.
How do I fix CVE-2026-21641?
To fix CVE-2026-21641, update to the latest version of Revive Adserver which includes a patch for the authorization bypass.
Who is affected by CVE-2026-21641?
Users of Revive Adserver who have permissions to delete trackers are affected by CVE-2026-21641.
What can attackers do with CVE-2026-21641?
Attackers can exploit CVE-2026-21641 to delete trackers owned by other accounts, compromising ad tracking and analytics.
Is there a workaround for CVE-2026-21641?
A temporary workaround for CVE-2026-21641 is to restrict tracker deletion permissions to only allow owners to delete their own trackers until a patch is applied.