Authorization Bypass in Revive Adserver by Revive Adserver Inc.
CVE-2026-82978

4.3MEDIUM

Key Information:

Vendor

Revive

Status
Adserver
Vendor
CVE Published:
11 November 2026

What is CVE-2026-82978?

An authorization bypass vulnerability in Revive Adserver versions 6.0.8 and earlier allows an authenticated manager to improperly create delivery rule sets in another agency's account. The flaw arises from the server's reliance on the submitted agency identifier, which can be manipulated, enabling unauthorized access and creation of objects by changing the agencyid parameter. Revive Adserver corrected this issue in version 6.0.9 by ensuring that the agency identifier is derived from the authenticated user's account instead of the submitted form data, thereby enhancing the security of agency data.

Affected Version(s)

Adserver 0 <= 6.0.8

References

https://hackerone.com/reports/3929216

CVSS V3.0

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shmulik Cohen
Dang Hung Vi
.