CVE-2026-44957: Medium severity Revive Adserver Revive Adserver vulnerability
A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier. The API allowed entities to be reassigned to different parent entities, leading to inconsistent ownership relationships. This issue was exploitable only in combination with CVE‑2026‑34917 or with third‑party API extensions that expose API functionality to low‑privileged users. Access control checks have been added to validate access to parent entities in the API modify methods.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44957?
The severity of CVE-2026-44957 is medium with a score of 4.3.
What is the vulnerability CVE-2026-44957 about?
CVE-2026-44957 is a missing access control check in the XML-RPC API of Revive Adserver that allows entities to be reassigned to different parent entities.
How do I fix CVE-2026-44957?
To fix CVE-2026-44957, upgrade to the latest version of Revive Adserver that addresses this vulnerability.
Who is affected by CVE-2026-44957?
Users of Revive Adserver version 6.0.6 and earlier are affected by CVE-2026-44957.
Can CVE-2026-44957 lead to unauthorized actions?
Yes, CVE-2026-44957 could potentially allow unauthorized actions due to improper access controls in the API.