CVE-2026-68485
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
An authorization bypass in website-index.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to view another agency's website listing by changing the agencyid request parameter. Disclosed information includes website names, identifiers and timestamps. Detailed website pages continue to enforce ownership checks. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than the request.
| CWE | CWE-639 |
| Vendor | revive |
| Product | adserver |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for revive adserver
Be the first to know when new medium vulnerabilities affecting revive adserver are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Affected Versions
Revive / Adserver
0 ≤ 6.0.8
Credits
Shmulik Cohen