Log in Start free

Vulnerability · Published Jun 23, 2026 · Assigned by hackerone

CVE-2026-44958

Medium 5.4

In plain English

A medium-severity improper access control in Adserver from Revive. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.0)5.4Medium
Exploit odds (30 days)0.3%top 72.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions. The status field has been removed from the hidden form fields in the banner edit screen.

Affected products (as reported)

VendorProductVersions
Revive Adserver 0 – through 6.0.6

Weakness: CWE-284 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References