This vulnerability is a bypass of ownership validation in Revive Adserver linking script, allowing a low‑privileged user to link trackers to campaigns owned by other managers, resulting in inconsistent ownership records. The flaw is an improper access control weakness (CWE‑284). The attack permits the attacker to associate data across managerial boundaries without authorization, potentially leading to data integrity concerns and unauthorized management of tracking information.

Affected systems are Revive Adserver installations running version 6.0.7 or any prior release.

The CVSS score of 4.3 indicates low to moderate severity. No EP current exploitation probability is not quantified, but the bug could be targeted by attackers seeking to re‑associate trackers with campaigns across managerial boundaries. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to authenticate as a low‑privileged user and submit a crafted request to tracker‑campaigns.php. The attack requires no special code execution or elevated privileges beyond the normal user level, but the impact is misattribution of tracking data.