CVE-2026-21641: Aquaplatform Revive Adserver

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.

Affected products

• Aquaplatform Revive Adserver: up to and including 6.0.4

Published 2026-01-20. Last modified 2026-06-17.