CVE-2026-50739
Revive Adserver Tracker-Campaign Linking Authorization Bypass
Description
A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the `tracker-campaigns.php` script in Revive Adserver 6.0.7 and earlier. As a result, a low‑privileged user could link their trackers to campaigns owned by other managers on the same instance, leading to inconsistent ownership relationships.
INFO
Published Date :
June 26, 2026, 1:11 a.m.
Last Modified :
June 26, 2026, 1:11 a.m.
Remotely Exploit :
No
Source :
hackerone
Solution
- Update Revive Adserver to version 6.0.8.
- Apply proper ownership validation to the reverse operation.
- Ensure all campaign and tracker links are validated.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-50739 vulnerability anywhere in the article.