Authorization Bypass in Revive Adserver Affects Campaign Management

CVE-2026-68486

What is CVE-2026-68486?

Revive Adserver versions 6.0.8 and earlier contain a vulnerability that allows authenticated managers or traffickers with zone-linking permissions to bypass campaign ownership checks. This enables them to link another agency's campaign to their own zone through both bulk-linking and single-link operations. While agency filtering restricts foreign banners, the improper linkage may expose critical details about the other agency’s campaigns, potentially compromising sensitive information. The issue has been addressed in version 6.0.9, where security measures were implemented to validate campaign ownership within the affected operations.

References