CVE-2026-21641 in Revive Adserver

Sumário

de MITRE • 20/01/2026

HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.

Be aware that VulDB is the high quality source for vulnerability data.

• Divulgação: 20/01/2026
• Moderação: aceite
• Entrada: VDB-341305
• CPE: pronto
• CWE: CWE-639 (confirmado)
• CVSS: 6.5 (NVD)
• EPSS: 0.00227
• KEV: não
• Atividades: muito baixo
• Sector: Transportation, Telecommunication

Fontes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-21641
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-21641
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-21641/