---
id: "CVE-2026-68486"
page: "https://infrastack.ai/live/CVE-2026-68486"
kind: "vulnerability"
aliases: ["CVE-2026-68486"]
title: "Revive Adserver: campaign-zone linking lets users link other agencies' campaigns"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "revive-adserver", "self-hosted"]
not_affected_if: ["single-agency-install", "version-6.0.9-or-later"]
published_at: "2026-11-11T18:19:48+00:00"
first_seen_at: "2026-11-11T18:28:43+00:00"
updated_at: "2026-11-11T18:29:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68486", "first_seen_at": "2026-11-11T18:28:43+00:00"}]
exploit_sources: []
---

# Revive Adserver: campaign-zone linking lets users link other agencies' campaigns

Link for people: https://infrastack.ai/live/CVE-2026-68486 (this .md is for agents)

Revive Adserver 6.0.8 and earlier lack ownership checks when linking campaigns to zones, so an authenticated manager or trafficker can link another agency's campaign to their own zone. The linked-campaign listing can then reveal that foreign campaign's name, type and identifier.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Revive Adserver version against the `6.0.8` range in the sources.
- Review which users hold manager or zone-linking trafficker permissions.

## Fix

- Revive Adserver: upgrade to `6.0.9`, which validates campaign ownership in the affected operations.

## Timeline

- 2026-11-11T18:28:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-68486

## From the sources

An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with zone-linking permissions, to associate another agency's campaign with their own zone. Campaign ownership checks are missing from the bulk-linking and single-link operations in zone-include.php and the XML-RPC campaign-linking method. Although agency filtering prevents foreign banners from being linked, the unauthorized association can expose the foreign campaign's name, type and identifier in the linked-campaign listing. The issue is fixed in Revive Adserver 6.0.9 by validating campaign ownership in the affected operations.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_