IDOR in Banner Deletion: When Parent Validation Isn't Enough

Revive Adserver validates you own a campaign, but never checks if you own the banner you're deleting. Any manager can sabotage any other manager's ads.