What is the CVSS score of CVE-2026-50743?

CVE-2026-50743 has a CVSS 3.0 base score of 5.4 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Revive Adserver CVE-2026-50743

EUVD-2026-46027 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-20 hackerone

GHSA-h857-j7g6-gpwf

PHP CSRF Adserver Revive

5.4

CVSS 3.0 · Vendor: hackerone

Severity by source

Vendor (hackerone) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

No attacker privileges required (PR:N); admin interaction mandatory (UI:R); impact limited to ad zone integrity and potential delivery disruption, no confidentiality breach.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (hackerone).

CVSS VectorVendor: hackerone

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 18:25 vuln.today

DescriptionCVE.org

A CSRF vulnerability exists in the zone-include.php script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered via crafted GET or POST requests without any verification of the CSRF token, allowing an attacker to perform these actions on behalf of an authenticated administrator.

AnalysisAI

Cross-site request forgery in Revive Adserver 6.0.7 allows an unauthenticated remote attacker to manipulate ad zone configurations - linking or unlinking banners and campaigns to zones - by tricking an authenticated administrator into loading a crafted page or request. The zone-include.php script accepts both GET and POST requests for these state-changing operations without verifying any CSRF token, meaning the browser's ambient session credentials are sufficient to authorize the action. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Technical ContextAI

Revive Adserver is an open-source PHP-based ad serving platform used to manage and deliver digital advertising. The affected endpoint, zone-include.php, handles the administrative function of associating (linking) and disassociating (unlinking) advertising banners and campaigns with delivery zones. CWE-352 (Cross-Site Request Forgery) describes the root cause: the server fails to distinguish between intentional requests from an authenticated administrator and forged requests submitted on their behalf by a third-party origin. Because the endpoint accepts both GET and POST HTTP methods for state-modifying operations, an attacker has multiple delivery vectors. The CPE string cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:* combined with EUVD-2026-46027 data indicates all versions from 0 through 6.0.7 are affected.

RemediationAI

No vendor-released patched version has been independently confirmed in the available data; the fix version must be verified against the HackerOne report at https://hackerone.com/reports/3781691 or the Revive Adserver project release notes. As an immediate compensating control, administrators should add CSRF token validation to the zone-include.php endpoint and reject requests that arrive via GET for state-modifying operations, enforcing POST-only with token verification. Additionally, configuring session cookies with the SameSite=Strict attribute will prevent cross-origin requests from carrying the session credential, mitigating CSRF broadly across the application. Restricting the administrative interface to trusted IP ranges via web server access controls (e.g., Apache Allow/Deny or nginx allow/deny directives) reduces attack surface while a permanent fix is applied. Note that IP restriction alone does not fully mitigate CSRF if the attacker can route through a trusted host.