CVE-2026-44958
Description
An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions. The status field has been removed from the hidden form fields in the banner edit screen.
Summary dbcve.org
Revive Adserver 6.0.6 and earlier contains an access control bypass in banner-edit.php where the banner status field could be overwritten based solely on banner edit permissions, allowing advertiser-level users to activate or deactivate banners even when they lack status-change permissions. The vulnerability stems from the status field being included in hidden form fields, enabling privilege escalation. The fix removes the status field from hidden form fields in the banner edit screen.
Mitigation
Upgrade Revive Adserver to a version newer than 6.0.6, or apply the vendor patch that removes the status field from hidden form fields in banner-edit.php and implements proper permission checks for banner status changes.