{"id":"CVE-2026-82978","kind":"vulnerability","aliases":["CVE-2026-82978"],"related":[],"title":"Revive Adserver: managers can create rules in other agencies' accounts","description":"An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to create a delivery rule set belonging to another agency by changing the submitted agencyid parameter. The server trusts the submitted agency identifier when inserting the new rule set, allowing unauthorized creation of objects in another agency's account. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than submitted form data and removing the agency identifier from the form's hidden fields.","summary":"Revive Adserver's channel-edit.php trusts a submitted agency ID when saving a new delivery rule set. An authenticated manager can change that ID and create objects inside another agency's account.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","revive-adserver","self-hosted"],"not_affected_if":["auth-required","single-agency"],"how_to_check":"- Check the installed Revive Adserver version; versions `6.0.8` and earlier are affected.\n- Look at the Revive Adserver package or image tag in your deployment files.","fix":"- Revive Adserver: move to `6.0.9` or later, which takes the agency ID from the logged-in account.","status":"open","published_at":"2026-11-11T18:19:49+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","triaged_at":"2026-11-11T18:29:44+00:00","updated_at":"2026-11-11T18:29:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T18:29:44Z","model":"claude-haiku-5-5","output":{"fix":"- Revive Adserver: move to `6.0.9` or later, which takes the agency ID from the logged-in account.","reach":"network","title":"Revive Adserver: managers can create rules in other agencies' accounts","impact":"medium","summary":"Revive Adserver's channel-edit.php trusts a submitted agency ID when saving a new delivery rule set. An authenticated manager can change that ID and create objects inside another agency's account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["revive-adserver","self-hosted","php"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated manager creates delivery rules inside another agency's account.","analyst_note":"","how_to_check":"- Check the installed Revive Adserver version; versions `6.0.8` and earlier are affected.\n- Look at the Revive Adserver package or image tag in your deployment files.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-agency","auth-required"],"who_is_affected":"Teams that run Revive Adserver with multiple agencies or manager accounts. Exposure needs a manager login; single-agency installs have less to lose.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000693,"input_tokens":4646,"output_tokens":457,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-82978':13A,16A '6.0.8':64C '6.0.9':117C 'account':10A,55B,109C,126C 'adserv':2A,21B,26B,63C,116C 'agenc':9A,32B,53B,80C,92C,107C,121C,135C 'agencyid':85C 'allow':67C,100C 'anoth':52B,79C,106C 'authent':42B,69C,125C 'author':57C 'belong':77C 'bypass':58C 'chang':45B,82C 'channel-edit.php':28B,60C 'creat':5A,49B,72C 'creation':102C 'cve':11A,14A 'data':131C 'deliveri':38B,74C 'earlier':66C 'field':142C 'fix':113C 'form':130C,139C 'hidden':141C 'host':24B 'id':33B,47B 'identifi':93C,122C,136C 'insert':95C 'insid':51B 'issu':111C 'manag':3A,43B,70C 'new':37B,97C 'object':50B,104C 'obtain':119C 'packag':17B 'paramet':86C 'php':18B 'rather':127C 'remov':133C 'reviv':1A,20B,25B,62C,115C 'revive-adserv':19B 'rule':6A,39B,75C,98C 'save':35B 'self':23B 'self-host':22B 'server':88C 'set':40B,76C,99C 'submit':31B,84C,91C,129C 'trust':29B,89C 'unauthor':101C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Revive Adserver with multiple agencies or manager accounts. Exposure needs a manager login; single-agency installs have less to lose.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","php","reviveadserver","selfhosted"],"campaign_type":null,"search_a":"'-2026':12A,15A '-82978':13A,16A 'account':10A 'adserv':2A 'agenc':9A 'creat':5A 'cve':11A,14A 'manag':3A 'reviv':1A 'rule':6A","search_b":"'account':55B 'adserv':21B,26B 'agenc':32B,53B 'anoth':52B 'authent':42B 'chang':45B 'channel-edit.php':28B 'creat':49B 'deliveri':38B 'host':24B 'id':33B,47B 'insid':51B 'manag':43B 'new':37B 'object':50B 'packag':17B 'php':18B 'reviv':20B,25B 'revive-adserv':19B 'rule':39B 'save':35B 'self':23B 'self-host':22B 'set':40B 'submit':31B 'trust':29B","search_c":"'6.0.8':64C '6.0.9':117C 'account':109C,126C 'adserv':63C,116C 'agenc':80C,92C,107C,121C,135C 'agencyid':85C 'allow':67C,100C 'anoth':79C,106C 'authent':69C,125C 'author':57C 'belong':77C 'bypass':58C 'chang':82C 'channel-edit.php':60C 'creat':72C 'creation':102C 'data':131C 'deliveri':74C 'earlier':66C 'field':142C 'fix':113C 'form':130C,139C 'hidden':141C 'identifi':93C,122C,136C 'insert':95C 'issu':111C 'manag':70C 'new':97C 'object':104C 'obtain':119C 'paramet':86C 'rather':127C 'remov':133C 'reviv':62C,115C 'rule':75C,98C 'server':88C 'set':76C,99C 'submit':84C,91C,129C 'trust':89C 'unauthor':101C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T18:19:49+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82978","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82978","severity":null,"published_at":"2026-11-11T18:19:49+00:00","modified_at":"2026-11-11T18:19:49+00:00","first_seen_at":"2026-11-11T18:28:43+00:00","fetched_at":"2026-11-11T18:28:43+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}