{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34912", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "state": "PUBLISHED", "assignerShortName": "hackerone", "dateReserved": "2026-03-31T15:00:06.522Z", "datePublished": "2026-06-23T16:14:38.094Z", "dateUpdated": "2026-06-23T17:41:50.468Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and earlier, or via its API allows a low\u2011privileged user could link their zones to banners or campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that banners and campaigns can only be linked to zones managed by the same account."}], "affected": [{"defaultStatus": "unaffected", "vendor": "Revive", "product": "Adserver", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "6.0.6", "versionType": "semver"}]}], "references": [{"url": "https://hackerone.com/reports/3650504"}], "metrics": [{"cvssV3_0": {"version": "3.0", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control - Generic"}]}], "credits": [{"lang": "en", "value": "Ahmed Ghadban (DarkyOS)", "type": "reporter"}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-06-23T16:14:38.094Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-23T17:41:45.454939Z", "id": "CVE-2026-34912", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T17:41:50.468Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34912", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T17:41:45.454939Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T17:41:47.603Z"}}], "cna": {"credits": [{"lang": "en", "type": "reporter", "value": "Ahmed Ghadban (DarkyOS)"}], "metrics": [{"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "Revive", "product": "Adserver", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "6.0.6"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://hackerone.com/reports/3650504"}], "descriptions": [{"lang": "en", "value": "A missing access control check when linking banners or campaigns to a zone through the zone-include.php script of Revive Adserver 6.0.6 and earlier, or via its API allows a low\u2011privileged user could link their zones to banners or campaigns owned by other managers on the same instance, resulting in inconsistent ownership relationships. Ownership validation has been added to ensure that banners and campaigns can only be linked to zones managed by the same account."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control - Generic"}]}], "providerMetadata": {"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "shortName": "hackerone", "dateUpdated": "2026-06-23T16:14:38.094Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34912", "state": "PUBLISHED", "dateUpdated": "2026-06-23T17:41:50.468Z", "dateReserved": "2026-03-31T15:00:06.522Z", "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1", "datePublished": "2026-06-23T16:14:38.094Z", "assignerShortName": "hackerone"}, "dataVersion": "5.2"}

{}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.0.6]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Adserver", "source": "cna", "vendor": "Revive"}, "product": "adserver", "vendor": "revive"}], "created": "2026-06-23T19:30:04.663762+00:00", "title": "Missing Access Control Allows Low\u2011Privileged User to Link Zones to Banners/Campaigns of Other Managers", "updated": "2026-06-23T20:15:04.422389+00:00", "vendors": ["revive", "revive$PRODUCT$adserver"]}