Revive Adserver: Authorization bypass in channel-edit.php
Summary
Revive Adserver 6.0.8 and earlier contains an authorization bypass in channel-edit.php. An authenticated manager can change the submitted agencyid parameter to create a delivery rule set in another agency's account. Exploitation requires a valid manager login and affects integrity only; the risk is mainly relevant on installations that host several agencies.
Affected
- Revive Adserver 0 through 6.0.8
Fixed in
- Revive Adserver 6.0.9 (obtains the agency ID from the authenticated account and removes it from the form's hidden fields)
Workaround
- Unknown. No vendor-documented workaround was found.
- Interim measures (not from a vendor source): limit manager accounts, review manager accounts and their agency assignments, and restrict admin access by VPN or IP allowlist.
Exploitation
- Not known to be exploited (OffSeq). Not listed in CISA KEV at the time of research. No public proof of concept found.
Our recommendation
- Upgrade to Revive Adserver 6.0.9 or later.
- Until the upgrade, keep the admin panel off the public internet and review manager accounts and agency assignments.
- Check the vendor release notes and the related Revive 6.0.8-and-earlier fixes in the same release.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-82978 www.cve.org
- HackerOne report 3929216 hackerone.com
- OffSeq: CVE-2026-82978 threat details radar.offseq.com
- OffSeq: authorization bypass in channel-edit.php radar.offseq.com
- Strix: CVE-2026-82978 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 21:16.
Original description (NVD)
An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to create a delivery rule set belonging to another agency by changing the submitted agencyid parameter. The server trusts the submitted agency identifier when inserting the new rule set, allowing unauthorized creation of objects in another agency's account. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than submitted form data and removing the agency identifier from the form's hidden fields.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.