EUVD-2026-38502
GHSA-4c2p-w68w-9rgw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
AC:H reflects the mandatory chaining prerequisite (CVE-2026-34917 or non-default extension); PR:L matches required authenticated low-privileged API access; no confidentiality or availability impact applies.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
1DescriptionCVE.org
A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier. The API allowed entities to be reassigned to different parent entities, leading to inconsistent ownership relationships. This issue was exploitable only in combination with CVE‑2026‑34917 or with third‑party API extensions that expose API functionality to low‑privileged users. Access control checks have been added to validate access to parent entities in the API modify methods.
AnalysisAI
Missing access control on XML-RPC API modify methods in Revive Adserver 6.0.6 and earlier permits authenticated low-privileged users to reassign entities to arbitrary parent entities, corrupting ownership relationships across campaigns, zones, or banners. This flaw is not independently exploitable - it requires chaining with CVE-2026-34917 or the presence of third-party API extensions that expose modify methods to low-privileged users, materially narrowing real-world risk. A vendor fix adding parent-entity access validation has been issued; no public exploit has been identified at time of analysis.
Technical ContextAI
Revive Adserver is an open-source ad serving platform that exposes a programmatic XML-RPC API for managing advertising entities such as campaigns, banners, and zones. The affected component is the set of modify methods within this API (CPE: cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:*), which lacked validation that the requesting principal had legitimate access rights over the target parent entity at the time of reassignment. The root cause class is CWE-284 (Improper Access Control): the authorization check was simply absent from the modify method path, so any caller with API access could specify an out-of-scope parent entity in their request payload without being rejected. This is a server-side enforcement gap rather than a client-side bypass or protocol weakness.
RemediationAI
Upgrade Revive Adserver to the release in which access control validation on parent entities has been added to the XML-RPC API modify methods, as confirmed by the vendor fix described in HackerOne report https://hackerone.com/reports/3677576. The exact patched version number is not specified in currently available data - consult the official Revive Adserver changelog or the HackerOne report for the precise release. Where immediate upgrade is not possible, restrict network-level access to the XML-RPC API endpoint to trusted administrator IP ranges only, which eliminates the network attack surface without application changes. Additionally, audit and disable any third-party API extensions that expose modify methods to low-privileged users, as these are one of the two conditions enabling exploitation. Ensuring CVE-2026-34917 is also patched is essential, since that vulnerability forms the other exploit prerequisite chain.
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. Rated high severity (CVSS 7.5), this vuln
Remote code execution in Revive Adserver is reachable by authenticated low-privilege users who bypass the prior fix for
Authenticated PHP code injection in Revive Adserver 6.0.6 and earlier allows a low-privileged user to smuggle an unexpec
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows authenticated low-privileged users to inject arbitrary S
Reflected cross-site scripting in Revive Adserver's stats-video.php script allows remote attackers to inject arbitrary J
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows a low-privileged authenticated user to exfiltrate databa
Cross-site request forgery in Revive Adserver 6.0.7 allows an unauthenticated remote attacker to manipulate ad zone conf
Reflected XSS in Revive Adserver 6.0.7 and earlier allows a low-privileged user to inject unsanitized JavaScript via the
Stored cross-site scripting in Revive Adserver 6.0.7 allows an authenticated low-privilege attacker to inject persistent
Privilege escalation within Revive Adserver 6.0.6 and earlier allows authenticated advertiser-level users to activate or
Session context confusion in Revive Adserver allows a low-privileged web admin console user to reuse their session ID ag
Session fixation via failed authentication in Revive Adserver 6.0.7's XML-RPC API allows a low-privileged attacker to by
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today