---
id: "CVE-2026-107247"
page: "https://infrastack.ai/live/CVE-2026-107247"
kind: "vulnerability"
aliases: ["CVE-2026-107247"]
title: "Revive Adserver: agency managers can reach other agencies' campaigns through query parameters"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ad-tech", "package", "revive-adserver", "self-hosted"]
not_affected_if: ["single-agency-install", "version-6.0.9-or-later"]
published_at: "2026-11-11T18:18:24+00:00"
first_seen_at: "2026-11-11T18:28:42+00:00"
updated_at: "2026-11-11T18:29:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107247", "first_seen_at": "2026-11-11T18:28:42+00:00"}]
exploit_sources: []
---

# Revive Adserver: agency managers can reach other agencies' campaigns through query parameters

Link for people: https://infrastack.ai/live/CVE-2026-107247 (this .md is for agents)

Revive Adserver 6.0.0 through 6.0.8 gives GET parameters precedence over POST parameters in its admin forms, so an authenticated manager limited to one agency can send one object ID in the query string and another in the form body. The permission check and the change then hit different objects, letting the manager modify other agencies' campaigns and read campaign and banner data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Revive Adserver version (`6.0.0` through `6.0.8` are affected)
- Look for the regression commit `156dee7bc3283c128f35e5a31bb305054cc8de1b` in the deployed code if you build from source

## Fix

- Revive Adserver: upgrade to `6.0.9`, which restores POST precedence in global input registration

## Timeline

- 2026-11-11T18:28:42+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107247

## From the sources

An authorization bypass in Revive Adserver 6.0.0 through 6.0.8 allows an authenticated manager restricted to one agency to access or modify resources belonging to another agency. Global input registration gives GET parameters precedence over POST parameters, while submitted administration forms use POST values. By supplying authorized object identifiers in the query string and different identifiers in the POST body, an attacker can cause permission checks and subsequent operations to target different objects. This permits unauthorized cross-agency changes, campaign ownership reassignment and disclosure of campaign and banner data. The regression was introduced in commit 156dee7bc3283c128f35e5a31bb305054cc8de1b and is fixed in Revive Adserver 6.0.9 by restoring POST precedence in global input registration.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_