Authorization Bypass Vulnerability in Revive Adserver by Revive Adserver
CVE-2026-68485

4.3MEDIUM

Key Information:

Vendor

Revive

Status
Adserver
Vendor
CVE Published:
11 November 2026

What is CVE-2026-68485?

An authorization bypass vulnerability exists in the 'website-index.php' file of Revive Adserver (versions 6.0.8 and earlier). This flaw allows an authenticated manager, who should only have access to their assigned agency, to view website listings of other agencies by manipulating the agencyid parameter in requests. The exposed information includes identifiers, names, and timestamps associated with websites that do not belong to the manager's agency. The issue has been addressed in version 6.0.9 by ensuring that the agency identifier is derived from the authenticated user's account, rather than being dictated by the request parameters.

Affected Version(s)

Adserver 0 <= 6.0.8

References

https://hackerone.com/reports/3883840

CVSS V3.0

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shmulik Cohen
.