This vulnerability is a bypass of a previous fix (CVE-2026-34913) related to ownership validation in Revive Adserver. Specifically, the reverse operation of linking campaigns and trackers via the tracker-campaigns.php script lacked proper ownership checks. Consequently, a low-privileged user can associate their trackers with campaigns managed by other users on the same instance, causing inconsistent ownership relationships. The CVSS 3.0 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

The vulnerability allows unauthorized linkage of trackers to campaigns owned by other managers, potentially causing data integrity issues within the Revive Adserver environment. There is no impact on confidentiality or availability. This could lead to confusion or mismanagement of campaign ownership but does not directly expose sensitive data or disrupt service availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should monitor user permissions and restrict low-privileged user capabilities related to campaign and tracker management where possible.