MEDIUMCVSS v3 4.3Vulnerability
CVE-2026-68485
An authorization bypass in website-index.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to view another agency's website listing by changing the agencyid request parameter. Disclosed information includes website names, identifiers and timestamps. Detailed website pages continue to enforce ownership checks. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than the request.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-11T23:49:45.533241+00:00
- Cvss score
- 4.3
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-11T23:50:18+00:00
- Score
- 4.3
- Last source
- NVD
- Cvss version
- 3.0
- Cve id
- CVE-2026-68485
- Cvss vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- First seen by Signal
- 2026-11-11T19:44:24+00:00
- Name
- CVE-2026-68485
- Vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Published at
- 2026-11-11T18:19:48.823
- Last modified
- 2026-11-11T18:19:48.823
Related Entities (1)
HAS_WEAKNESS (1)
Related research
Explore deeper with Ninja Signal's threat intelligence graph