EUVD-2026-38505
GHSA-hqvw-xvc4-mxq4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as advertiser with banner edit rights
-
DeliveryNavigate to banner-edit.php for an editable banner
-
ExploitIntercept outbound form submission via proxy or browser tools
-
ExecutionModify hidden status field value
-
PersistSubmit manipulated form to server
-
ImpactBanner activation state changed without authorized permission
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid advertiser-level account within the Revive Adserver instance - unauthenticated access is not sufficient. The attacker must hold banner edit permissions for at least one banner, but need not hold explicit banner status management permissions (the absence of that second permission is precisely what the bypass circumvents). The affected endpoint is banner-edit.php, which must be reachable over the network. Exploitation is limited to toggling banner activation state; no data exfiltration or full platform compromise is possible through this vector alone. Organizations that do not provision external advertiser accounts, or that grant all banner editors full status control anyway, face no meaningful exploitable gap. |
| Impact | The CVSS 3.0 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) accurately reflects the constrained impact: an authenticated advertiser can alter banner status but cannot read sensitive data or fully disable the platform. Attack complexity is low and no user interaction is required, making exploitation trivial for any account holder. However, exploitation is bounded by the requirement for a valid advertiser-level credential, limiting the attack surface to organizations that provision advertiser accounts in Revive Adserver. There is no EPSS data available in the provided intelligence, no CISA KEV entry, and no confirmed public POC. SSVC signals suggest: exploitation status is none/unproven, the flaw is automatable once credentials are obtained, and technical impact is partial. Real-world priority is low-to-medium for most organizations - high only where tight control over banner lifecycle (e.g., regulatory or contractual compliance around ad display) is a business requirement. |
| Exploit ScenarioDerived | An authenticated advertiser holding banner edit permissions but not status management permissions navigates to banner-edit.php for any banner they can edit, intercepts the form submission (via browser developer tools or a proxy), and modifies the hidden status field to activate or deactivate the target banner before submitting. No public POC has been identified at time of analysis, but the technique requires only basic web manipulation skills. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 23, 2026
Privilege escalation within Revive Adserver 6.0.6 and earlier allows authenticated advertiser-level users to activate or deactivate banner ads regardless of whether those permissions were explicitly granted. The banner-edit.php script evaluated banner status changes based solely on banner edit permissions, treating status modification as implicitly authorized whenever edit access existed. No public exploit code has been identified at time of analysis, and this is not listed in the CISA KEV catalog, but the low attack complexity and network accessibility make it straightforward for any credentialed advertiser to abuse.
RemediationAI
Upgrade Revive Adserver to a version released after 6.0.6 in which the status field has been removed from the hidden form fields in the banner edit screen, as confirmed by the vulnerability description. The exact patched release version is not independently confirmed in the provided data beyond the description of the fix - verify the specific release number against the official Revive Adserver changelog or the HackerOne report at https://hackerone.com/reports/3678828 before deploying. As a compensating control prior to patching, administrators should audit advertiser-level accounts and restrict banner edit access only to accounts that are also explicitly authorized to manage banner status; this limits exposure to accounts where the permission gap matters. Alternatively, network-layer controls restricting access to banner-edit.php from untrusted advertiser sessions can reduce exposure, though this may impact legitimate workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Revive Adserver is an open-source, PHP-based ad serving platform identified by CPE cpe:2.3:a:revive:adserver:*:*:*:*:*:*:*:*. The root cause is CWE-284 (Improper Access Control): the banner-edit.php script exposed banner activation status as a hidden HTML form field. When an advertiser submitted the banner edit form, the server accepted the status field value and applied it without verifying that the submitting user held distinct status-management privileges. This is a classic client-side trust failure - the server relied on a hidden form field to carry authorization-relevant state rather than enforcing permission checks server-side. The fix removes the status field from the hidden form fields in the banner edit screen, eliminating the bypass vector at the presentation layer.
Know when Adserver gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-accessible endpoint requires a valid advertiser credential (PR:L); impact is confined to unauthorized banner status toggles, affecting only integrity and availability at low severity with no confidentiality exposure.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
DescriptionCVE.org
An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions. The status field has been removed from the hidden form fields in the banner edit screen.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks. Rated high severity (CVSS 7.5), this vuln
Authenticated PHP code injection in Revive Adserver 6.0.6 and earlier allows a low-privileged user to smuggle an unexpec
Remote code execution in Revive Adserver is reachable by authenticated low-privilege users who bypass the prior fix for
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows authenticated low-privileged users to inject arbitrary S
Blind SQL injection in Revive Adserver 6.0.6 and earlier allows a low-privileged authenticated user to exfiltrate databa
Reflected cross-site scripting in Revive Adserver's stats-video.php script allows remote attackers to inject arbitrary J
Cross-site request forgery in Revive Adserver 6.0.7 allows an unauthenticated remote attacker to manipulate ad zone conf
Reflected XSS in Revive Adserver 6.0.7 and earlier allows a low-privileged user to inject unsanitized JavaScript via the
Stored cross-site scripting in Revive Adserver 6.0.7 allows an authenticated low-privilege attacker to inject persistent
Session context confusion in Revive Adserver allows a low-privileged web admin console user to reuse their session ID ag
Improper access control in Revive Adserver 6.0.6 and earlier allows an authenticated low-privileged user to link their o
Missing access control on XML-RPC API modify methods in Revive Adserver 6.0.6 and earlier permits authenticated low-priv
Exploit-DB