CVE-2026-21641

Medium · 6.5

CVSS

6.5

EPSS

0.3%

Published

Jan 20, 2026

CISA due date

—

The record

HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.

Affected packages

Ecosystem	Package	Introduced	Fixed