Description
HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Revive | Revive Adserver | 6 – ≤ 6.0.4 | — |