tracker-invocation.php · Cross-site Request Forgery Vulnerability
Source GCVE Database
Not known to be exploited · CVSS 4.3 Medium · fixed in 6.0.9 : update Adserver when convenient.
Data as of 11 Nov 2026, 19:38 UTC
Thin evidence
One scorer or none| CNA (hackerone) | CVSS 3.0 | 4.3 |
|---|
- Patch
- Available – fixed in 6.0.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 11 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 11 Nov 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| ReviveAdserver | Affected
| Fixed in– |
Packagistrevive/adserverpkg:composer/revive/adserverOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade to Revive Adserver version 6.0.9 or later, which removes the vulnerable tracker-modification handler. No other mitigation is indicated as the fix eliminates the attack vector.
Description
A cross-site request forgery (CSRF) vulnerability exists in tracker-invocation.php in Revive Adserver version 6.0.8 and earlier. This flaw allows an attacker to modify a tracker's name, description, or advertiser assignment by leveraging an authenticated victim's permissions. The vulnerability arises from a leftover state-changing handler that processes request parameters without verifying a CSRF token. Exploitation requires victim interaction and the victim's session credentials to be included in the request. The issue is addressed in Revive Adserver 6.0.9 by removing the unused tracker-modification handler.