What is the CVSS score of CVE-2026-44958?

CVE-2026-44958 has a CVSS 3.0 base score of 5.4 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Revive Adserver CVE-2026-44958

EUVD-2026-38505 MEDIUM

Improper Access Control (CWE-284)

2026-06-23 hackerone

GHSA-hqvw-xvc4-mxq4

PHP Authentication Bypass Adserver Revive

5.4

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-accessible endpoint requires a valid advertiser credential (PR:L); impact is confined to unauthorized banner status toggles, affecting only integrity and availability at low severity with no confidentiality exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 23, 2026 - 17:08 vuln.today

DescriptionCVE.org

An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions. The status field has been removed from the hidden form fields in the banner edit screen.

AnalysisAI

Privilege escalation within Revive Adserver 6.0.6 and earlier allows authenticated advertiser-level users to activate or deactivate banner ads regardless of whether those permissions were explicitly granted. The banner-edit.php script evaluated banner status changes based solely on banner edit permissions, treating status modification as implicitly authorized whenever edit access existed. No public exploit code has been identified at time of analysis, and this is not listed in the CISA KEV catalog, but the low attack complexity and network accessibility make it straightforward for any credentialed advertiser to abuse.

Technical ContextAI

Revive Adserver is an open-source, PHP-based ad serving platform identified by CPE cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:*. The root cause is CWE-284 (Improper Access Control): the banner-edit.php script exposed banner activation status as a hidden HTML form field. When an advertiser submitted the banner edit form, the server accepted the status field value and applied it without verifying that the submitting user held distinct status-management privileges. This is a classic client-side trust failure - the server relied on a hidden form field to carry authorization-relevant state rather than enforcing permission checks server-side. The fix removes the status field from the hidden form fields in the banner edit screen, eliminating the bypass vector at the presentation layer.

RemediationAI

Upgrade Revive Adserver to a version released after 6.0.6 in which the status field has been removed from the hidden form fields in the banner edit screen, as confirmed by the vulnerability description. The exact patched release version is not independently confirmed in the provided data beyond the description of the fix - verify the specific release number against the official Revive Adserver changelog or the HackerOne report at https://hackerone.com/reports/3678828 before deploying. As a compensating control prior to patching, administrators should audit advertiser-level accounts and restrict banner edit access only to accounts that are also explicitly authorized to manage banner status; this limits exposure to accounts where the permission gap matters. Alternatively, network-layer controls restricting access to banner-edit.php from untrusted advertiser sessions can reduce exposure, though this may impact legitimate workflows.