CVE-2026-82978: Medium severity vulnerability
An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to create a delivery rule set belonging to another agency by changing the submitted agencyid parameter. The server trusts the submitted agency identifier when inserting the new rule set, allowing unauthorized creation of objects in another agency's account. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than submitted form data and removing the agency identifier from the form's hidden fields.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Revive Adserverto a version that resolves this vulnerability.Fixed in 6.0.9 - Configuration
Obtain the agency identifier from the authenticated account rather than submitted form data, and remove the agency identifier from the form's hidden fields.
Revive Adserver channel-edit.php agency identifier source = authenticated account
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated manager can exploit it. The attacker must be able to submit a request to channel-edit.php and alter the agencyid parameter.
What is the impact of successful exploitation?
The attacker can create a delivery rule set that belongs to another agency's account. The provided information describes unauthorized object creation; it does not indicate disclosure, modification, or deletion of existing data.
Are deployments running the fixed release affected?
No. Revive Adserver 6.0.9 fixes the issue by deriving the agency identifier from the authenticated account and removing the agency identifier from hidden form fields.
What can be done if upgrading is not immediately possible?
Restrict manager access to trusted users, since exploitation requires an authenticated manager account. Review newly created delivery rule sets for ownership by an agency different from the manager who created them.