Vulnerability record/PUBLISHED/Published Nov 11, 2026 17:30:37 UTC
CVE-2026-68485
An authorization bypass in website-index.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to view another agency's website listing by changing the agencyid request parameter. Disclosed information includes website names, identifiers and timestamps. Detailed website pages continue to enforce ownership checks. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than the request.
Base score4.3/ 10
SeverityMediumCVSS 3.0
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityLowAC
Privileges requiredLowPR
User interactionNoneUI
ScopeUnchangedS
Confidentiality impactLowC
Integrity impactNoneI
Availability impactNoneA
CVSS vector string
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityhackerone
Last updatedNov 11, 2026 17:30:37 UTC
PublishedNov 11, 2026 17:30:37 UTC
ReservedJul 30, 2026 15:00:00 UTC
Credits
- Shmulik Cohen