Revive Adserver Missing Ownership Validation IDOR Bypassing CVE-2026-34915 Fix

Vulnerability Overview Vulnerability Name: Missing ownership validation allows cross-manager tracker-campaign linking Vulnerability Description: HackerOne community member hakuopi (along with independent reporters sy2no, garuthacktivist, and aszh) reported a vulnerability that bypasses the fix for CVE-2026-34915. Proper ownership validation is not applied to the reverse operation, specifically linking campaigns owned by other managers to trackers via the script. This allows low-privilege users on the same instance to link trackers to campaigns owned by other managers, resulting in inconsistent ownership relationships. Scope Affected Versions: Revive Adserver 6.0.7 and earlier Severity: Medium (4.5) CVE ID: CVE-2026-50739, CVE-2026-34915 Remediation Status: Fixed Fixed On: June 23, 2026, at 1:40 PM UTC Remediation Measures: Ensure ownership validation is correctly applied in the reverse operation to prevent low-privilege users from linking campaigns owned by other managers to trackers. Timeline Report Submitted: June 3, 2026, at 9:00 PM UTC Reporter: hakuopi Vendor: Revive Adserver Participants: hakuopi, sy2no, garuthacktivist, aszh Status Changes: - June 3, 2026, at 9:00 PM UTC: hakuopi submitted the report - June 3, 2026, at 9:00 PM UTC: mbecatti (Revive Adserver staff) changed status to "Triaged" - June 3, 2026, at 9:44 PM UTC: sy2no submitted a duplicate report (#3781065) and was invited to participate in this report - June 3, 2026, at 9:44 PM UTC: hakuopi commented - June 3, 2026, at 9:51 PM UTC: mbecatti (Revive Adserver staff) commented - June 3, 2026, at 9:51 PM UTC: garuthacktivist submitted a duplicate report (#3784471) and was invited to participate in this report - June 3, 2026, at 6:33 PM UTC: aszh submitted a duplicate report (#3784848) and was invited to participate in this report - 7 days ago: mbecatti (Revive Adserver staff) closed the report and changed status to "Resolved" - 7 days ago: hakuopi commented - 5 days ago: mbecatti (Revive Adserver staff) updated CVE reference to CVE-2026-50739 - 5 days ago: mbecatti (Revive Adserver staff) commented Additional Information Report ID: #3780709 Disclosed On: June 23, 2026, at 1:40 PM UTC Vulnerability Type: Insecure Direct Object Reference (IDOR) Bounty: None Re-test: None Total Bounty: None Account Details: None

Goal Reached Thanks to every supporter — we hit 100%!

Revive Adserver Missing Ownership Validation IDOR Bypassing CVE-2026-34915 Fix