CVE-2026-107247: High severity vulnerability
An authorization bypass in Revive Adserver 6.0.0 through 6.0.8 allows an authenticated manager restricted to one agency to access or modify resources belonging to another agency. Global input registration gives GET parameters precedence over POST parameters, while submitted administration forms use POST values. By supplying authorized object identifiers in the query string and different identifiers in the POST body, an attacker can cause permission checks and subsequent operations to target different objects. This permits unauthorized cross-agency changes, campaign ownership reassignment and disclosure of campaign and banner data. The regression was introduced in commit 156dee7bc3283c128f35e5a31bb305054cc8de1b and is fixed in Revive Adserver 6.0.9 by restoring POST precedence in global input registration.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Revive Adserverto a version that resolves this vulnerability.Fixed in 6.0.9
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated manager account that is restricted to a single agency can exploit it. The flaw allows that user to access or modify resources assigned to another agency.
What does exploitation require?
The attacker needs to submit an administration form with authorized object identifiers in GET query parameters and different target identifiers in the POST body. The permission check uses the query-string values while the later operation can use the POST values.
Which versions are affected and what version fixes it?
Revive Adserver 6.0.0 through 6.0.8 are affected. Version 6.0.9 fixes the issue by restoring POST-value precedence during global input registration.
What could an attacker do after exploiting the bypass?
An attacker could make unauthorized cross-agency changes, reassign campaign ownership, and disclose campaign and banner data.