Revive Adserver: Authorization bypass via conflicting GET and POST parameters
Summary
Revive Adserver 6.0.0 through 6.0.8 contains an authorization bypass that lets an authenticated manager restricted to one agency access or modify resources of another agency. Global input registration gives GET parameters precedence over POST parameters, while administration forms use POST values, so permission checks and operations can target different objects. An attacker can thereby reassign campaign ownership across agencies and read campaign and banner data; the attack requires a valid manager account.
Affected
- Revive Adserver 6.0.0 through 6.0.8
- Introduced by commit 156dee7bc3283c128f35e5a31bb305054cc8de1b
Fixed in
- Revive Adserver 6.0.9 (restores POST precedence in global input registration)
Workaround
Unknown. No workaround was found in the sources; upgrading to 6.0.9 is the fix.
Exploitation
- Not known to be exploited (OffSeq tracker)
- Public proof of concept: unknown
- Not listed in CISA KEV as far as checked, not verified against the CISA site
Our recommendation
- Upgrade to Revive Adserver 6.0.9 or later; this also covers related agency and campaign issues fixed in 6.0.9
- Until the upgrade is done, limit manager accounts to the minimum needed
- Review audit logs for unexpected cross-agency changes
- Priority: high for installations with several agencies or reseller accounts, medium for single-tenant installations
- Check whether the admin interface is internet-facing
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record CVE-2026-107247 www.cve.org
- HackerOne report 3831102 hackerone.com
- CVE summary mirror (threatint) cve.threatint.com
- OffSeq tracker CVE-2026-107247 radar.offseq.com
- Revive Adserver FAQ www.revive-adserver.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 19:25.
Original description (NVD)
An authorization bypass in Revive Adserver 6.0.0 through 6.0.8 allows an authenticated manager restricted to one agency to access or modify resources belonging to another agency. Global input registration gives GET parameters precedence over POST parameters, while submitted administration forms use POST values. By supplying authorized object identifiers in the query string and different identifiers in the POST body, an attacker can cause permission checks and subsequent operations to target different objects. This permits unauthorized cross-agency changes, campaign ownership reassignment and disclosure of campaign and banner data. The regression was introduced in commit 156dee7bc3283c128f35e5a31bb305054cc8de1b and is fixed in Revive Adserver 6.0.9 by restoring POST precedence in global input registration.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.