The vulnerability is a missing access control check in the XML‑RPC API of Revive Adserver, which allows an authenticated entity to reassign any parent entity to another. This can lead to inconsistent ownership relationships and enable an attacker to elevate privileges or modify data that should be protected. The flaw is classified as CWE‑284 because it permits unauthorized resource manipulation.

Revive Adserver versions 6.0.6 and earlier are affected. The issue is only exploitable when the XML‑RPC modify methods are invoked, and it requires the presence of CVE‑2026‑34917 or third‑party API extensions that expose these methods to low‑privileged users.

The CVSS score of 4.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation. However, the attack vector involves API calls over XML‑RPC, which may be publicly exposed in some deployments. Successful exploitation requires both the missing access control and either the related CVE‑2026‑34917 or a vulnerable extension, limiting the attack surface.