PT-2026-51558 · Revive · Andserver

V3Rtical · Publicado 2026-06-23 · Atualizado 2026-06-23 · CVE-2026-44958

Mitre

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions. The status field has been removed from the hidden form fields in the banner edit screen.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-44958

Produtos afetados

Andserver

Referências · 2

• https://hackerone.com/reports/3678828 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-44958 · Nota de Segurança