---
id: "CVE-2026-68485"
page: "https://infrastack.ai/live/CVE-2026-68485"
kind: "vulnerability"
aliases: ["CVE-2026-68485"]
title: "Revive Adserver: agency manager can list another agency's websites"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Revive Adserver", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ad-servers", "package", "php", "revive-adserver"]
not_affected_if: ["managed-hosting", "no-restricted-manager-accounts", "single-agency"]
published_at: "2026-11-11T18:19:48+00:00"
first_seen_at: "2026-11-11T18:28:43+00:00"
updated_at: "2026-11-11T18:29:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68485", "first_seen_at": "2026-11-11T18:28:43+00:00"}]
exploit_sources: []
---

# Revive Adserver: agency manager can list another agency's websites

Link for people: https://infrastack.ai/live/CVE-2026-68485 (this .md is for agents)

A manager restricted to one agency can change the agencyid parameter in website-index.php to view another agency's website listing. The exposed data is website names, identifiers and timestamps, while detailed website pages still enforce ownership.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Revive Adserver affected range not listed fixed no fixed version listed

## How to check

- Check the installed Revive Adserver version; affected versions are `6.0.8` and earlier.
- Look for a manager-level account restricted to one agency that can reach website-index.php.

## Fix

- Revive Adserver: upgrade to `6.0.9`, which takes the agency identifier from the authenticated account instead of the request.

## Timeline

- 2026-11-11T18:28:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-68485

## From the sources

An authorization bypass in website-index.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to view another agency's website listing by changing the agencyid request parameter. Disclosed information includes website names, identifiers and timestamps. Detailed website pages continue to enforce ownership checks. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than the request.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_