CVE-2026-34913: Medium severity Revive Adserver Revive Adserver vulnerability
A missing access control check when linking trackers to campaigns through the campaign-trackers.php script of Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to link their trackers to campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that campaigns can only be linked to trackers owned by the same advertiser.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34913?
CVE-2026-34913 has a medium severity rating of 4.3.
How can I fix CVE-2026-34913?
To fix CVE-2026-34913, ensure that proper access control checks are implemented in the campaign-trackers.php script of Revive Adserver.
What vulnerability does CVE-2026-34913 describe?
CVE-2026-34913 describes a missing access control check that allows low-privileged users to link trackers to campaigns owned by other managers.
What versions of Revive Adserver are affected by CVE-2026-34913?
CVE-2026-34913 affects Revive Adserver version 6.0.6 and earlier.
What impact does CVE-2026-34913 have on Revive Adserver?
The impact of CVE-2026-34913 includes inconsistent ownership relationships due to unauthorized linking of trackers by low-privileged users.