EUVD-2026-38502
GHSA-4c2p-w68w-9rgw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged API credentials
-
DeliveryExploit CVE-2026-34917 or leverage third-party extension
-
ExploitSend crafted XML-RPC modify request
-
ExecutionBypass parent-entity access check
-
PersistReassign entities to unauthorized parent
-
ImpactCorrupt cross-tenant ownership in adserver
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation is conditional on one of two non-default prerequisites: (1) CVE-2026-34917 must also be present and unpatched in the same installation, providing the attacker a pathway to elevate or misuse API access, OR (2) a third-party API extension must be deployed that exposes Revive Adserver's XML-RPC modify methods to low-privileged users - not a default configuration. In the absence of either condition, this vulnerability cannot be exploited independently. Additionally, a valid low-privileged API credential is required (CVSS PR:L), ruling out unauthenticated exploitation. Impact is limited to integrity corruption of entity ownership with no confidentiality exposure and no availability impact, further bounding the blast radius. |
| Impact | The vendor-assigned CVSS 3.0 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) reflects network-accessible but authenticated exploitation with limited integrity-only impact. However, the CVSS vector does not capture the most important real-world constraint: the description explicitly states the flaw is only exploitable in combination with CVE-2026-34917 or when non-default third-party API extensions are deployed. This conditional dependency is a significant downward risk modifier absent from the base score. There is no CISA KEV listing, no EPSS data provided, and no public exploit code identified, consistent with a low exploitation probability. This vulnerability should be patched as part of routine maintenance rather than emergency response, unless the target environment is also running unpatched CVE-2026-34917 or non-standard API extensions that elevate the combined risk. |
| Exploit ScenarioDerived | An attacker holding a low-privileged Revive Adserver account - obtained either legitimately or through CVE-2026-34917 - submits a crafted XML-RPC modify request targeting an entity reassignment method, specifying a parent entity (e.g., a campaign or advertiser) outside their permitted scope. The server, lacking the access check, processes the reassignment and persists the corrupted ownership relationship, potentially allowing the attacker to inject content or manipulate billing and reporting across tenant boundaries. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 23, 2026
Missing access control on XML-RPC API modify methods in Revive Adserver 6.0.6 and earlier permits authenticated low-privileged users to reassign entities to arbitrary parent entities, corrupting ownership relationships across campaigns, zones, or banners. This flaw is not independently exploitable - it requires chaining with CVE-2026-34917 or the presence of third-party API extensions that expose modify methods to low-privileged users, materially narrowing real-world risk. A vendor fix adding parent-entity access validation has been issued; no public exploit has been identified at time of analysis.
RemediationAI
Upgrade Revive Adserver to the release in which access control validation on parent entities has been added to the XML-RPC API modify methods, as confirmed by the vendor fix described in HackerOne report https://hackerone.com/reports/3677576. The exact patched version number is not specified in currently available data - consult the official Revive Adserver changelog or the HackerOne report for the precise release. Where immediate upgrade is not possible, restrict network-level access to the XML-RPC API endpoint to trusted administrator IP ranges only, which eliminates the network attack surface without application changes. Additionally, audit and disable any third-party API extensions that expose modify methods to low-privileged users, as these are one of the two conditions enabling exploitation. Ensuring CVE-2026-34917 is also patched is essential, since that vulnerability forms the other exploit prerequisite chain.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Revive Adserver is an open-source ad serving platform that exposes a programmatic XML-RPC API for managing advertising entities such as campaigns, banners, and zones. The affected component is the set of modify methods within this API (CPE: cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:*), which lacked validation that the requesting principal had legitimate access rights over the target parent entity at the time of reassignment. The root cause class is CWE-284 (Improper Access Control): the authorization check was simply absent from the modify method path, so any caller with API access could specify an out-of-scope parent entity in their request payload without being rejected. This is a server-side enforcement gap rather than a client-side bypass or protocol weakness.
Know when Adserver gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
AC:H reflects the mandatory chaining prerequisite (CVE-2026-34917 or non-default extension); PR:L matches required authenticated low-privileged API access; no confidentiality or availability impact applies.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
DescriptionCVE.org
A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier. The API allowed entities to be reassigned to different parent entities, leading to inconsistent ownership relationships. This issue was exploitable only in combination with CVE‑2026‑34917 or with third‑party API extensions that expose API functionality to low‑privileged users. Access control checks have been added to validate access to parent entities in the API modify methods.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. Rated high severity (CVSS 7.5), this vuln
Authenticated PHP code injection in Revive Adserver 6.0.6 and earlier allows a low-privileged user to smuggle an unexpec
Remote code execution in Revive Adserver is reachable by authenticated low-privilege users who bypass the prior fix for
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows authenticated low-privileged users to inject arbitrary S
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows a low-privileged authenticated user to exfiltrate databa
Reflected cross-site scripting in Revive Adserver's stats-video.php script allows remote attackers to inject arbitrary J
Privilege escalation within Revive Adserver 6.0.6 and earlier allows authenticated advertiser-level users to activate or
Cross-site request forgery in Revive Adserver 6.0.7 allows an unauthenticated remote attacker to manipulate ad zone conf
Reflected XSS in Revive Adserver 6.0.7 and earlier allows a low-privileged user to inject unsanitized JavaScript via the
Stored cross-site scripting in Revive Adserver 6.0.7 allows an authenticated low-privilege attacker to inject persistent
Session context confusion in Revive Adserver allows a low-privileged web admin console user to reuse their session ID ag
Improper access control in Revive Adserver 6.0.6 and earlier allows an authenticated low-privileged user to link their o
Exploit-DB