{"id":"CVE-2026-68486","kind":"vulnerability","aliases":["CVE-2026-68486"],"related":[],"title":"Revive Adserver: campaign-zone linking lets users link other agencies' campaigns","description":"An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with zone-linking permissions, to associate another agency's campaign with their own zone. Campaign ownership checks are missing from the bulk-linking and single-link operations in zone-include.php and the XML-RPC campaign-linking method. Although agency filtering prevents foreign banners from being linked, the unauthorized association can expose the foreign campaign's name, type and identifier in the linked-campaign listing. The issue is fixed in Revive Adserver 6.0.9 by validating campaign ownership in the affected operations.","summary":"Revive Adserver 6.0.8 and earlier lack ownership checks when linking campaigns to zones, so an authenticated manager or trafficker can link another agency's campaign to their own zone. The linked-campaign listing can then reveal that foreign campaign's name, type and identifier.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","revive-adserver","self-hosted"],"not_affected_if":["single-agency-install","version-6.0.9-or-later"],"how_to_check":"- Check the installed Revive Adserver version against the `6.0.8` range in the sources.\n- Review which users hold manager or zone-linking trafficker permissions.","fix":"- Revive Adserver: upgrade to `6.0.9`, which validates campaign ownership in the affected operations.","status":"open","published_at":"2026-11-11T18:19:48+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","triaged_at":"2026-11-11T18:29:38+00:00","updated_at":"2026-11-11T18:29:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T18:29:38Z","model":"claude-haiku-5-5","output":{"fix":"- Revive Adserver: upgrade to `6.0.9`, which validates campaign ownership in the affected operations.","reach":"internet","title":"Revive Adserver: campaign-zone linking lets users link other agencies' campaigns","impact":"low","summary":"Revive Adserver 6.0.8 and earlier lack ownership checks when linking campaigns to zones, so an authenticated manager or trafficker can link another agency's campaign to their own zone. The linked-campaign listing can then reveal that foreign campaign's name, type and identifier.","audience":"businesses","category":"package","nicknames":[],"who_cares":["revive-adserver","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Foreign campaign name, type and identifier exposed in listings","analyst_note":"Ecosystem and product_name unverified: no products listed, and the reach field assumes a web-facing admin interface.","how_to_check":"- Check the installed Revive Adserver version against the `6.0.8` range in the sources.\n- Review which users hold manager or zone-linking trafficker permissions.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-agency-install","version-6.0.9-or-later"],"who_is_affected":"Teams that run self-hosted Revive Adserver 6.0.8 or earlier with multiple agencies or advertisers sharing one instance. The exposure needs an authenticated manager or a trafficker with zone-linking permissions, so single-tenant installs with trusted users carry less risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000759,"input_tokens":4679,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-68486':15A,18A '6.0.8':29B,83C '6.0.9':169C 'adserv':2A,23B,28B,82C,168C 'affect':176C 'agenc':11A,49B,101C,135C 'allow':86C 'although':134C 'anoth':48B,100C 'associ':99C,145C 'authent':42B,88C 'author':73C 'banner':139C 'bulk':116C 'bulk-link':115C 'bypass':74C 'campaign':4A,12A,37B,51B,59B,66B,77C,103C,108C,131C,150C,160C,172C 'campaign-link':130C 'campaign-zon':3A,76C 'check':34B,110C 'cve':13A,16A 'earlier':31B,85C 'expos':147C 'filter':136C 'fix':165C 'foreign':65B,138C,149C 'host':26B 'identifi':71B,155C 'issu':163C 'lack':32B 'let':7A 'link':6A,9A,36B,47B,58B,79C,96C,117C,121C,132C,142C,159C 'linked-campaign':57B,158C 'list':60B,161C 'manag':43B,89C 'method':133C 'miss':112C 'name':68B,152C 'oper':122C,177C 'ownership':33B,109C,173C 'packag':19B 'permiss':97C 'php':20B 'prevent':137C 'reveal':63B 'reviv':1A,22B,27B,81C,167C 'revive-adserv':21B 'rpc':129C 'self':25B 'self-host':24B 'singl':120C 'single-link':119C 'traffick':45B,92C 'type':69B,153C 'unauthor':144C 'user':8A 'valid':171C 'xml':128C 'xml-rpc':127C 'zone':5A,39B,55B,78C,95C,107C 'zone-include.php':124C 'zone-link':94C","nicknames":[],"mitigations":[],"who_affected":"Teams that run self-hosted Revive Adserver 6.0.8 or earlier with multiple agencies or advertisers sharing one instance. The exposure needs an authenticated manager or a trafficker with zone-linking permissions, so single-tenant installs with trusted users carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","php","reviveadserver","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-68486':15A,18A 'adserv':2A 'agenc':11A 'campaign':4A,12A 'campaign-zon':3A 'cve':13A,16A 'let':7A 'link':6A,9A 'reviv':1A 'user':8A 'zone':5A","search_b":"'6.0.8':29B 'adserv':23B,28B 'agenc':49B 'anoth':48B 'authent':42B 'campaign':37B,51B,59B,66B 'check':34B 'earlier':31B 'foreign':65B 'host':26B 'identifi':71B 'lack':32B 'link':36B,47B,58B 'linked-campaign':57B 'list':60B 'manag':43B 'name':68B 'ownership':33B 'packag':19B 'php':20B 'reveal':63B 'reviv':22B,27B 'revive-adserv':21B 'self':25B 'self-host':24B 'traffick':45B 'type':69B 'zone':39B,55B","search_c":"'6.0.8':83C '6.0.9':169C 'adserv':82C,168C 'affect':176C 'agenc':101C,135C 'allow':86C 'although':134C 'anoth':100C 'associ':99C,145C 'authent':88C 'author':73C 'banner':139C 'bulk':116C 'bulk-link':115C 'bypass':74C 'campaign':77C,103C,108C,131C,150C,160C,172C 'campaign-link':130C 'campaign-zon':76C 'check':110C 'earlier':85C 'expos':147C 'filter':136C 'fix':165C 'foreign':138C,149C 'identifi':155C 'issu':163C 'link':79C,96C,117C,121C,132C,142C,159C 'linked-campaign':158C 'list':161C 'manag':89C 'method':133C 'miss':112C 'name':152C 'oper':122C,177C 'ownership':109C,173C 'permiss':97C 'prevent':137C 'reviv':81C,167C 'rpc':129C 'singl':120C 'single-link':119C 'traffick':92C 'type':153C 'unauthor':144C 'valid':171C 'xml':128C 'xml-rpc':127C 'zone':78C,95C,107C 'zone-include.php':124C 'zone-link':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:19:48+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68486","severity":null,"published_at":"2026-11-11T18:19:48+00:00","modified_at":"2026-11-11T18:19:48+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","fetched_at":"2026-11-11T18:28:43+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}