CVE-2026-21641

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21641", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-01-01T15:00:02.340Z", "datePublished": "2026-01-20T20:48:47.885Z", "dateUpdated": "2026-01-21T18:52:48.506Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts."}], "affected": [{"defaultStatus": "unaffected", "vendor": "Revive", "product": "Revive Adserver", "versions": [{"version": "6", "status": "affected", "lessThanOrEqual": "6.0.4", "versionType": "semver"}]}], "references": [{"url": "https://hackerone.com/reports/3445710"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "baseScore": 7.1, "baseSeverity": "HIGH"}}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-01-20T20:48:47.885Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "CWE-285 Improper Authorization"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-21T18:38:03.148978Z", "id": "CVE-2026-21641", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T18:52:48.506Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21641", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-21T18:38:03.148978Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "CWE-285 Improper Authorization"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-21T18:39:15.272Z"}}], "cna": {"metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L"}}], "affected": [{"vendor": "Revive", "product": "Revive Adserver", "versions": [{"status": "affected", "version": "6", "versionType": "semver", "lessThanOrEqual": "6.0.4"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://hackerone.com/reports/3445710"}], "descriptions": [{"lang": "en", "value": "HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts."}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-01-20T20:48:47.885Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21641", "state": "PUBLISHED", "dateUpdated": "2026-01-21T18:52:48.506Z", "dateReserved": "2026-01-01T15:00:02.340Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-01-20T20:48:47.885Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Revive Adserver", "vendor": "Revive", "versions": [{"lessThanOrEqual": "6.0.4", "status": "affected", "version": "6", "versionType": "semver"}]}], "source": "support@hackerone.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:aquaplatform:revive_adserver:*:*:*:*:*:*:*:*", "matchCriteriaId": "FB1E6D97-42AD-4A1B-89B3-86356A4B5E59", "versionEndIncluding": "6.0.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts."}, {"lang": "es", "value": "El miembro de la comunidad de HackerOne Jad Ghamloush (0xjad) ha informado de una vulnerabilidad de omisi\u00f3n de autorizaci\u00f3n en el script `tracker-delete.php` de Revive Adserver. A los usuarios con permisos para eliminar rastreadores se les permite err\u00f3neamente eliminar rastreadores que pertenecen a otras cuentas."}], "id": "CVE-2026-21641", "lastModified": "2026-06-17T10:18:51.670", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "support@hackerone.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21641", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-21T18:38:03.148978Z", "version": "2.0.3"}}]}, "published": "2026-01-20T21:16:06.187", "references": [{"source": "support@hackerone.com", "tags": ["Third Party Advisory"], "url": "https://hackerone.com/reports/3445710"}], "sourceIdentifier": "support@hackerone.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T15:45:19.683684+00:00", "value": {"mitigation_remediation": ["Upgrade to the latest Revive Adserver version that contains the authorization fix for tracker-delete.php.", "Restrict delete permissions to administrators or trusted accounts for critical tracking data.", "Implement logging and audit mechanisms to detect and review unexpected tracker deletions."], "summary": {"action": "Patch", "impact": "Authorization Bypass"}, "threat_synthesis": {"affected_systems": "The flaw affects Revive Adserver by Revive. No specific version information is supplied, so any deployment of Revive Adserver that includes the tracker\u2011delete.php script before the vendor\u2019s fix is potentially vulnerable.", "description_and_impact": "The vulnerability in the tracker-delete.php script of Revive Adserver allows users who have permission to delete trackers to remove trackers belonging to other user accounts. This bypasses the intended ownership checks and results in unauthorized deletion of data, potentially causing loss of tracking information, disruption of advertising services, and violation of data integrity. The weakness corresponds to improper authorization (CWE\u2011285).", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity, and the EPSS score of < 1% shows a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. An attacker would need to be an authenticated user who has delete permissions and target the tracker\u2011delete.php endpoint. The fact that this endpoint is accessed over HTTP is inferred from typical web application behavior and is not explicitly stated in the advisory. This flaw only allows deletion of data and does not grant code execution or privilege escalation, limiting impact to integrity and availability of the trackers owned by other accounts."}}}}, "created": "2026-01-21T11:18:43.724590+00:00", "title": "Authorization Bypass in Revive Adserver Tracker Deletion", "updated": "2026-04-18T16:00:04.272760+00:00", "vendors": ["revive", "revive$PRODUCT$adserver"]}