CVE-2026-21641 — Revive / Revive Adserver

CVE-2026-21641

Revive / Revive Adserver PUBLISHED

Description (CNA)

HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.

Affected (CNA)

Vendor / product	Versions
Revive / Revive Adserver	affected 6 through 6.0.4

CWE

No CWE identifiers supplied.

References

https://hackerone.com/reports/3445710

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.