Revive Adserver: Authorization bypass in website listing via agencyid parameter
Summary
Revive Adserver 6.0.8 and earlier contains an authorization bypass (IDOR) in website-index.php. An authenticated manager restricted to one agency can change the agencyid parameter to view the website listing of another agency. The disclosed data includes website names, identifiers and timestamps, while the detailed website pages still enforce ownership checks.
Affected
- Revive Adserver 0 to 6.0.8
Fixed in
- Revive Adserver 6.0.9 (the agency ID is taken from the authenticated account instead of the request). Based on the HackerOne report and third-party sources; the vendor release page was not verified.
Workaround
- Unknown. No workaround is documented in the sources.
- Interim measure: restrict access to the admin interface to trusted networks or VPN until the upgrade is complete.
Exploitation
- Not known to be exploited in the wild, according to OffSeq as of 11 Nov 2026.
- No public proof of concept found in the sources reviewed.
- VulDB lists the status as Confirmed.
Our recommendation
- Identify all Revive Adserver instances and their versions.
- Upgrade instances at 6.0.8 or earlier to 6.0.9, after checking the vendor's release page.
- Until the upgrade is complete, restrict admin access to trusted networks or VPN and make sure untrusted users do not hold manager accounts on shared instances.
- The same release also fixes other vulnerabilities, including CVE-2026-107247 and CVE-2026-107662, so one upgrade covers them.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-68485 www.cve.org
- HackerOne report 3883840 hackerone.com
- OffSeq Radar: CVE-2026-68485 radar.offseq.com
- OffSeq Radar: authorization bypass in website-index.php radar.offseq.com
- VulDB entry 435888 vuldb.com
- Strix CVE-2026-68485 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:16.
Original description (NVD)
An authorization bypass in website-index.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to view another agency's website listing by changing the agencyid request parameter. Disclosed information includes website names, identifiers and timestamps. Detailed website pages continue to enforce ownership checks. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than the request.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.