CVE-2026-82978 · Package
NO FIX YET · SEE WHAT TO DO
Revive Adserver's channel-edit.php trusts a submitted agency ID when saving a new delivery rule set. An authenticated manager can change that ID and create objects inside another agency's account.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run Revive Adserver with multiple agencies or manager accounts. Exposure needs a manager login; single-agency installs have less to lose.
Not affected if auth-required, single-agency
Who cares php, revive-adserver, self-hosted
6.0.8 and earlier are affected.6.0.9 or later, which takes the agency ID from the logged-in account.An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to create a delivery rule set belonging to another agency by changing the submitted agencyid parameter. The server trusts the submitted agency identifier when inserting the new rule set, allowing unauthorized creation of objects in another agency's account. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than submitted form data and removing the agency identifier from the form's hidden fields.
This page as .md · .json · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.