---
id: "CVE-2026-82978"
page: "https://infrastack.ai/live/CVE-2026-82978"
kind: "vulnerability"
aliases: ["CVE-2026-82978"]
title: "Revive Adserver: managers can create rules in other agencies' accounts"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "revive-adserver", "self-hosted"]
not_affected_if: ["auth-required", "single-agency"]
published_at: "2026-11-11T18:19:49+00:00"
first_seen_at: "2026-11-11T18:28:43+00:00"
updated_at: "2026-11-11T18:29:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82978", "first_seen_at": "2026-11-11T18:28:43+00:00"}]
exploit_sources: []
---

# Revive Adserver: managers can create rules in other agencies' accounts

Link for people: https://infrastack.ai/live/CVE-2026-82978 (this .md is for agents)

Revive Adserver's channel-edit.php trusts a submitted agency ID when saving a new delivery rule set. An authenticated manager can change that ID and create objects inside another agency's account.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Revive Adserver version; versions `6.0.8` and earlier are affected.
- Look at the Revive Adserver package or image tag in your deployment files.

## Fix

- Revive Adserver: move to `6.0.9` or later, which takes the agency ID from the logged-in account.

## Timeline

- 2026-11-11T18:28:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82978

## From the sources

An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to create a delivery rule set belonging to another agency by changing the submitted agencyid parameter. The server trusts the submitted agency identifier when inserting the new rule set, allowing unauthorized creation of objects in another agency's account. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than submitted form data and removing the agency identifier from the form's hidden fields.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_