REVIVE ADSERVER · CVE-2026-68485 · Package
NO FIX YET · SEE WHAT TO DO
A manager restricted to one agency can change the agencyid parameter in website-index.php to view another agency's website listing. The exposed data is website names, identifiers and timestamps, while detailed website pages still enforce ownership.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Installations of Revive Adserver 6.0.8 and earlier where agency-restricted manager accounts exist and can log in. Single-agency or single-tenant installs with no restricted manager accounts have little exposure to this cross-agency listing.
Not affected if managed-hosting, no-restricted-manager-accounts, single-agency
Who cares ad-servers, php, revive-adserver
6.0.8 and earlier.6.0.9, which takes the agency identifier from the authenticated account instead of the request.An authorization bypass in website-index.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to view another agency's website listing by changing the agencyid request parameter. Disclosed information includes website names, identifiers and timestamps. Detailed website pages continue to enforce ownership checks. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than the request.
This page as .md · .json · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.