🔺Severity: Medium
👽 Reporter: hakuopi
⭐️ Reputation: 97
🛠 State: resolved
💼 Team: Revive Adserver
💵 Bounty: null
🕐 Submitted: 2026-06-03
⏰ Disclosed: 2026-06-25 13:40:14
📝 Summary: A vulnerability was reported in Revive Adserver version 6.0.7 and earlier that allowed a low-privileged user to link their trackers to campaigns owned by other managers on the same instance. This was due to a lack of proper ownership validation in the
tracker-campaigns.php script, which handled the reverse operation of linking campaigns and trackers.📂 Report JSON File: 3780709
@hackeronereports