Broken Access Control allows advertiser accounts to delete trackers they do not own

Summary

Security advisory: REVIVE-SA-2026-001

Description

HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the tracker-delete.php script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.

##Details The Revive Adserver tracker-delete.php script was not properly checking ownership of the clientid parameter before deleting the resource. That allows several types of malicious attacks and highly affects the data integrity of the affected system.