Authorization Bypass in Revive Adserver Affecting Multiple Agencies

CVE-2026-107247

What is CVE-2026-107247?

An authorization bypass flaw in Revive Adserver versions 6.0.0 to 6.0.8 enables authenticated managers, restricted to their own agency, to unlawfully access or alter resources belonging to other agencies. The issue arises from global input registration that prioritizes GET parameters over POST parameters. By manipulating object identifiers in the query string and the POST request body, an attacker can circumvent permission checks and perform unauthorized operations. This vulnerability allows for cross-agency modifications, reassignment of campaign ownership, and exposure of sensitive campaign and banner data. The issue has been rectified in Revive Adserver version 6.0.9 by realigning the precedence of POST values in the global input registration.

References