CVE-2026-50739: Medium severity Revive Adserver Revive Adserver vulnerability
A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the tracker-campaigns.php script in Revive Adserver 6.0.7 and earlier. As a result, a low‑privileged user could link their trackers to campaigns owned by other managers on the same instance, leading to inconsistent ownership relationships.
Affected Software
Event History
Frequently Asked Questions
What is the risk level of CVE-2026-50739?
CVE-2026-50739 has a medium severity rating of 4.3.
How can I fix CVE-2026-50739?
To mitigate CVE-2026-50739, ensure that proper ownership validation is applied in the `tracker-campaigns.php` script in Revive Adserver.
What are the potential impacts of CVE-2026-50739?
CVE-2026-50739 allows a low-privileged user to link their trackers to campaigns, potentially leading to unauthorized data manipulation.
Which versions of software are affected by CVE-2026-50739?
CVE-2026-50739 affects Revive Adserver versions 6.0.7 and earlier.
What does CVE-2026-50739 imply about user privileges?
CVE-2026-50739 indicates that low-privileged users can exploit the vulnerability if ownership validation is not properly enforced.