A missing access control check in Revive Adserver’s campaign‑trackers.php script allows a low‑privileged user on an instance running version 6.0.6 or earlier to link their trackers to campaigns owned by other managers. This manipulation creates inconsistent ownership relationships, potentially affecting reporting and business logic. The flaw is an unauthorized access weakness, identified as CWE‑284.

This flaw affects Revive Adserver 6.0.6 and all earlier releases. Users running these versions are susceptible unless the issue is patched or the affected functionality is disabled.

The CVSS score of 4.3 indicates moderate severity. While the EPSS score is not available, the lack of a CISA KEV listing suggests no publicly known exploits yet. An attacker only needs authenticated access to the web interface and can exploit the vulnerability by accessing campaign‑trackers.php with appropriate parameters. The attack vector is inferred to be from the web application, originating from any user who can reach the script, rather than requiring privileged OS access.