Access Control Bypass in Revive Adserver Affects User Permissions

CVE-2026-44958

What is CVE-2026-44958?

An access control bypass vulnerability in Revive Adserver enables an advertiser-level user to modify the status of banners, regardless of whether they possess the necessary permissions. This flaw arises from the improper handling of permissions within the banner-edit.php script, which allowed unauthorized manipulation of banner statuses. With the status field removed from hidden form inputs, an attacker could exploit this vulnerability to activate or deactivate banners, undermining security measures and impacting ad management integrity.

References