| Package | Affected versions | Patched versions |
|---|---|---|
| revive adserver | < 6.0.8 | 6.0.8 |
A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the `tracker-campaigns.php` script in Revive Adserver 6.0.7 and earlier. As a result, a low‑privileged user could link their trackers to campaigns owned by other managers on the same instance, leading to inconsistent ownership relationships.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free