CVE-2026-44958: Medium severity Revive Adserver Revive Adserver vulnerability
An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions. The status field has been removed from the hidden form fields in the banner edit screen.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove the 'status' field from the hidden form fields in the banner edit screen (banner-edit.php) so the banner status cannot be overwritten based solely on banner edit permissions.
Revive Adserver (banner-edit.php / banner edit screen) hidden form field 'status' = removed
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44958?
CVE-2026-44958 has a medium severity rating of 5.4.
How does CVE-2026-44958 affect Revive Adserver?
CVE-2026-44958 allows an advertiser-level user to activate or deactivate a banner without the correct permissions.
What versions of Revive Adserver are impacted by CVE-2026-44958?
CVE-2026-44958 affects Revive Adserver version 6.0.6 and earlier.
How can I fix CVE-2026-44958?
To fix CVE-2026-44958, upgrade to a newer version of Revive Adserver that addresses the access control bypass.
What type of vulnerability is CVE-2026-44958 classified as?
CVE-2026-44958 is classified as an access control bypass vulnerability.