The vulnerability in the tracker-delete.php script of Revive Adserver allows users who have permission to delete trackers to remove trackers belonging to other user accounts. This bypasses the intended ownership checks and results in unauthorized deletion of data, potentially causing loss of tracking information, disruption of advertising services, and violation of data integrity. The weakness corresponds to improper authorization (CWE‑285).

The flaw affects Revive Adserver by Revive. No specific version information is supplied, so any deployment of Revive Adserver that includes the tracker‑delete.php script before the vendor’s fix is potentially vulnerable.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of < 1% shows a very low likelihood of exploitation. The vulnerability is not listed in CISA KEV. An attacker would need to be an authenticated user who has delete permissions and target the tracker‑delete.php endpoint. The fact that this endpoint is accessed over HTTP is inferred from typical web application behavior and is not explicitly stated in the advisory. This flaw only allows deletion of data and does not grant code execution or privilege escalation, limiting impact to integrity and availability of the trackers owned by other accounts.