{"id":"CVE-2026-68485","kind":"vulnerability","aliases":["CVE-2026-68485"],"related":[],"title":"Revive Adserver: agency manager can list another agency's websites","description":"An authorization bypass in website-index.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to view another agency's website listing by changing the agencyid request parameter. Disclosed information includes website names, identifiers and timestamps. Detailed website pages continue to enforce ownership checks. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than the request.","summary":"A manager restricted to one agency can change the agencyid parameter in website-index.php to view another agency's website listing. The exposed data is website names, identifiers and timestamps, while detailed website pages still enforce ownership.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Revive Adserver","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ad-servers","package","php","revive-adserver"],"not_affected_if":["managed-hosting","no-restricted-manager-accounts","single-agency"],"how_to_check":"- Check the installed Revive Adserver version; affected versions are `6.0.8` and earlier.\n- Look for a manager-level account restricted to one agency that can reach website-index.php.","fix":"- Revive Adserver: upgrade to `6.0.9`, which takes the agency identifier from the authenticated account instead of the request.","status":"open","published_at":"2026-11-11T18:19:48+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","triaged_at":"2026-11-11T18:29:46+00:00","updated_at":"2026-11-11T18:29:46+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T18:29:46Z","model":"claude-haiku-5-5","output":{"fix":"- Revive Adserver: upgrade to `6.0.9`, which takes the agency identifier from the authenticated account instead of the request.","reach":"internet","title":"Revive Adserver: agency manager can list another agency's websites","impact":"low","summary":"A manager restricted to one agency can change the agencyid parameter in website-index.php to view another agency's website listing. The exposed data is website names, identifiers and timestamps, while detailed website pages still enforce ownership.","audience":"businesses","category":"package","nicknames":[],"who_cares":["revive-adserver","php","ad-servers"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated manager reads website names and identifiers of other agencies","analyst_note":"","how_to_check":"- Check the installed Revive Adserver version; affected versions are `6.0.8` and earlier.\n- Look for a manager-level account restricted to one agency that can reach website-index.php.","plain_action":"","product_name":"Revive Adserver","needs_analyst":false,"not_affected_if":["managed-hosting","single-agency","no-restricted-manager-accounts"],"who_is_affected":"Installations of Revive Adserver 6.0.8 and earlier where agency-restricted manager accounts exist and can log in. Single-agency or single-tenant installs with no restricted manager accounts have little exposure to this cross-agency listing.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4614,"output_tokens":542,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-68485':13A,16A '6.0.8':71C '6.0.9':118C 'account':127C 'ad':20B 'ad-serv':19B 'adserv':2A,26B,70C,117C 'adserver':18A 'agenc':3A,8A,32B,43B,81C,85C,122C 'agencyid':36B,92C 'allow':74C 'anoth':7A,42B,84C 'authent':76C,126C 'author':64C 'bypass':65C 'chang':34B,90C 'check':110C 'continu':106C 'cve':11A,14A 'data':49B 'detail':57B,103C 'disclos':95C 'earlier':73C 'enforc':61B,108C 'expos':48B 'fix':114C 'identifi':53B,100C,123C 'includ':97C 'inform':96C 'issu':112C 'list':6A,46B,88C 'manag':4A,28B,77C 'name':52B,99C 'obtain':120C 'one':31B,80C 'ownership':62B,109C 'packag':22B 'page':59B,105C 'paramet':37B,94C 'php':23B 'rather':128C 'request':93C,131C 'restrict':29B,78C 'reviv':1A,25B,69C,116C 'revive':17A 'revive-adserv':24B 'server':21B 'still':60B 'timestamp':55B,102C 'view':41B,83C 'websit':10A,45B,51B,58B,87C,98C,104C 'website-index.php':39B,67C","nicknames":[],"mitigations":[],"who_affected":"Installations of Revive Adserver 6.0.8 and earlier where agency-restricted manager accounts exist and can log in. Single-agency or single-tenant installs with no restricted manager accounts have little exposure to this cross-agency listing.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["adserver","reviveadserver"],"ptokens":["adserver","revive"],"labels":["adservers","medium","package","php","reviveadserver","vendor"],"campaign_type":null,"search_a":"'-2026':12A,15A '-68485':13A,16A 'adserv':2A 'adserver':18A 'agenc':3A,8A 'anoth':7A 'cve':11A,14A 'list':6A 'manag':4A 'reviv':1A 'revive':17A 'websit':10A","search_b":"'ad':20B 'ad-serv':19B 'adserv':26B 'agenc':32B,43B 'agencyid':36B 'anoth':42B 'chang':34B 'data':49B 'detail':57B 'enforc':61B 'expos':48B 'identifi':53B 'list':46B 'manag':28B 'name':52B 'one':31B 'ownership':62B 'packag':22B 'page':59B 'paramet':37B 'php':23B 'restrict':29B 'reviv':25B 'revive-adserv':24B 'server':21B 'still':60B 'timestamp':55B 'view':41B 'websit':45B,51B,58B 'website-index.php':39B","search_c":"'6.0.8':71C '6.0.9':118C 'account':127C 'adserv':70C,117C 'agenc':81C,85C,122C 'agencyid':92C 'allow':74C 'anoth':84C 'authent':76C,126C 'author':64C 'bypass':65C 'chang':90C 'check':110C 'continu':106C 'detail':103C 'disclos':95C 'earlier':73C 'enforc':108C 'fix':114C 'identifi':100C,123C 'includ':97C 'inform':96C 'issu':112C 'list':88C 'manag':77C 'name':99C 'obtain':120C 'one':80C 'ownership':109C 'page':105C 'paramet':94C 'rather':128C 'request':93C,131C 'restrict':78C 'reviv':69C,116C 'timestamp':102C 'view':83C 'websit':87C,98C,104C 'website-index.php':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:19:48+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68485","severity":null,"published_at":"2026-11-11T18:19:48+00:00","modified_at":"2026-11-11T18:19:48+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","fetched_at":"2026-11-11T18:28:43+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}