CVE-2026-68485: Medium severity vulnerability
Published Nov 11, 2026
·Updated
An authorization bypass in website-index.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to view another agency's website listing by changing the agencyid request parameter. Disclosed information includes website names, identifiers and timestamps. Detailed website pages continue to enforce ownership checks. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than the request.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Revive Adserverto a version that resolves this vulnerability.Fixed in 6.0.9
Event History
Nov 11, 2026
CVE Published
via MITRE·05:30 PM
Data Sourced
via MITRE·05:30 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:19 PM
DescriptionSeverityWeakness