CVE-2026-77168 · Package
NO FIX YET · SEE WHAT TO DO
A leftover handler in tracker-invocation.php accepts changes to a tracker's name, description or advertiser assignment without checking a CSRF token. An attacker who tricks a logged-in administrator into visiting a malicious page can make those changes using the victim's permissions.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run Revive Adserver 6.0.8 or earlier as a self-hosted ad server. The flaw needs an authenticated administrator to be tricked into following a link or loading a page, so exposure is lower where admin users are few and trained to avoid untrusted links. The normal invocation-tag interface does not use the vulnerable handler.
Not affected if managed-hosting, version-6.0.9-or-later
Who cares php, revive-adserver, self-hosted
6.0.9.tracker-invocation.php in the install and confirm whether the tracker-modification handler is present.6.0.9, which removes the unused tracker-modification handler.A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an attacker to modify a tracker's name, description or advertiser assignment using an authenticated victim's permissions. A leftover state-changing handler accepts request parameters without verifying a CSRF token, although it is not used by the normal invocation-tag interface. Exploitation requires victim interaction and a request path that carries the victim's session credentials. The issue is fixed in Revive Adserver 6.0.9 by removing the unused tracker-modification handler.
This page as .md · .json · CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.