{"id":"CVE-2026-107247","kind":"vulnerability","aliases":["CVE-2026-107247"],"related":[],"title":"Revive Adserver: agency managers can reach other agencies' campaigns through query parameters","description":"An authorization bypass in Revive Adserver 6.0.0 through 6.0.8 allows an authenticated manager restricted to one agency to access or modify resources belonging to another agency. Global input registration gives GET parameters precedence over POST parameters, while submitted administration forms use POST values. By supplying authorized object identifiers in the query string and different identifiers in the POST body, an attacker can cause permission checks and subsequent operations to target different objects. This permits unauthorized cross-agency changes, campaign ownership reassignment and disclosure of campaign and banner data. The regression was introduced in commit 156dee7bc3283c128f35e5a31bb305054cc8de1b and is fixed in Revive Adserver 6.0.9 by restoring POST precedence in global input registration.","summary":"Revive Adserver 6.0.0 through 6.0.8 gives GET parameters precedence over POST parameters in its admin forms, so an authenticated manager limited to one agency can send one object ID in the query string and another in the form body. The permission check and the change then hit different objects, letting the manager modify other agencies' campaigns and read campaign and banner data.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ad-tech","package","revive-adserver","self-hosted"],"not_affected_if":["single-agency-install","version-6.0.9-or-later"],"how_to_check":"- Check the installed Revive Adserver version (`6.0.0` through `6.0.8` are affected)\n- Look for the regression commit `156dee7bc3283c128f35e5a31bb305054cc8de1b` in the deployed code if you build from source","fix":"- Revive Adserver: upgrade to `6.0.9`, which restores POST precedence in global input registration","status":"open","published_at":"2026-11-11T18:18:24+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","triaged_at":"2026-11-11T18:29:24+00:00","updated_at":"2026-11-11T18:29:24+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T18:29:24Z","model":"claude-haiku-5-5","output":{"fix":"- Revive Adserver: upgrade to `6.0.9`, which restores POST precedence in global input registration","reach":"network","title":"Revive Adserver: agency managers can reach other agencies' campaigns through query parameters","impact":"medium","summary":"Revive Adserver 6.0.0 through 6.0.8 gives GET parameters precedence over POST parameters in its admin forms, so an authenticated manager limited to one agency can send one object ID in the query string and another in the form body. The permission check and the change then hit different objects, letting the manager modify other agencies' campaigns and read campaign and banner data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["revive-adserver","self-hosted","ad-tech"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"cross-agency campaign changes and campaign data disclosure by authenticated managers","analyst_note":"","how_to_check":"- Check the installed Revive Adserver version (`6.0.0` through `6.0.8` are affected)\n- Look for the regression commit `156dee7bc3283c128f35e5a31bb305054cc8de1b` in the deployed code if you build from source","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-6.0.9-or-later","single-agency-install"],"who_is_affected":"Any Revive Adserver instance on 6.0.0 through 6.0.8 where more than one agency or manager account shares the admin interface. Single-agency installs with only trusted administrators face little added risk from cross-agency access. Instances on 6.0.9 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000773,"input_tokens":4720,"output_tokens":602,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107247':15A,18A '-2026':14A,17A '156dee7bc3283c128f35e5a31bb305054cc8de1b':186C '6.0.0':31B,97C '6.0.8':33B,99C '6.0.9':193C 'access':109C 'ad':20B 'ad-tech':19B 'admin':43B 'administr':129C 'adserv':2A,25B,30B,96C,192C 'agenc':3A,8A,52B,83B,107C,116C,168C 'allow':100C 'anoth':63B,115C 'attack':151C 'authent':47B,102C 'author':92C,136C 'banner':89B,178C 'belong':113C 'bodi':67B,149C 'bypass':93C 'campaign':9A,84B,87B,170C,176C 'caus':153C 'chang':73B,169C 'check':70B,155C 'commit':185C 'cross':167C 'cross-ag':166C 'cve':13A,16A 'data':90B,179C 'differ':76B,144C,161C 'disclosur':174C 'fix':189C 'form':44B,66B,130C 'get':35B,121C 'give':34B,120C 'global':117C,199C 'hit':75B 'host':28B 'id':57B 'identifi':138C,145C 'input':118C,200C 'introduc':183C 'let':78B 'limit':49B 'manag':4A,48B,80B,103C 'modifi':81B,111C 'object':56B,77B,137C,162C 'one':51B,55B,106C 'oper':158C 'ownership':171C 'packag':22B 'paramet':12A,36B,40B,122C,126C 'permiss':69B,154C 'permit':164C 'post':39B,125C,132C,148C,196C 'preced':37B,123C,197C 'queri':11A,60B,141C 'reach':6A 'read':86B 'reassign':172C 'registr':119C,201C 'regress':181C 'resourc':112C 'restor':195C 'restrict':104C 'reviv':1A,24B,29B,95C,191C 'revive-adserv':23B 'self':27B 'self-host':26B 'send':54B 'string':61B,142C 'submit':128C 'subsequ':157C 'suppli':135C 'target':160C 'tech':21B 'unauthor':165C 'use':131C 'valu':133C","nicknames":[],"mitigations":[],"who_affected":"Any Revive Adserver instance on 6.0.0 through 6.0.8 where more than one agency or manager account shares the admin interface. Single-agency installs with only trusted administrators face little added risk from cross-agency access. Instances on 6.0.9 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adtech","high","package","reviveadserver","selfhosted"],"campaign_type":null,"search_a":"'-107247':15A,18A '-2026':14A,17A 'adserv':2A 'agenc':3A,8A 'campaign':9A 'cve':13A,16A 'manag':4A 'paramet':12A 'queri':11A 'reach':6A 'reviv':1A","search_b":"'6.0.0':31B '6.0.8':33B 'ad':20B 'ad-tech':19B 'admin':43B 'adserv':25B,30B 'agenc':52B,83B 'anoth':63B 'authent':47B 'banner':89B 'bodi':67B 'campaign':84B,87B 'chang':73B 'check':70B 'data':90B 'differ':76B 'form':44B,66B 'get':35B 'give':34B 'hit':75B 'host':28B 'id':57B 'let':78B 'limit':49B 'manag':48B,80B 'modifi':81B 'object':56B,77B 'one':51B,55B 'packag':22B 'paramet':36B,40B 'permiss':69B 'post':39B 'preced':37B 'queri':60B 'read':86B 'reviv':24B,29B 'revive-adserv':23B 'self':27B 'self-host':26B 'send':54B 'string':61B 'tech':21B","search_c":"'156dee7bc3283c128f35e5a31bb305054cc8de1b':186C '6.0.0':97C '6.0.8':99C '6.0.9':193C 'access':109C 'administr':129C 'adserv':96C,192C 'agenc':107C,116C,168C 'allow':100C 'anoth':115C 'attack':151C 'authent':102C 'author':92C,136C 'banner':178C 'belong':113C 'bodi':149C 'bypass':93C 'campaign':170C,176C 'caus':153C 'chang':169C 'check':155C 'commit':185C 'cross':167C 'cross-ag':166C 'data':179C 'differ':144C,161C 'disclosur':174C 'fix':189C 'form':130C 'get':121C 'give':120C 'global':117C,199C 'identifi':138C,145C 'input':118C,200C 'introduc':183C 'manag':103C 'modifi':111C 'object':137C,162C 'one':106C 'oper':158C 'ownership':171C 'paramet':122C,126C 'permiss':154C 'permit':164C 'post':125C,132C,148C,196C 'preced':123C,197C 'queri':141C 'reassign':172C 'registr':119C,201C 'regress':181C 'resourc':112C 'restor':195C 'restrict':104C 'reviv':95C,191C 'string':142C 'submit':128C 'subsequ':157C 'suppli':135C 'target':160C 'unauthor':165C 'use':131C 'valu':133C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107247","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107247","severity":null,"published_at":"2026-11-11T18:18:24+00:00","modified_at":"2026-11-11T18:18:24+00:00","first_seen_at":"2026-11-11T18:28:42+00:00","fetched_at":"2026-11-11T18:28:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}