Back to overview

CVE-2026-44957

MEDIUM
4.3
CVSS 3.0
Description
A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier. The API allowed entities to be reassigned to different parent entities, leading to inconsistent ownership relationships. This issue was exploitable only in combination with CVE‑2026‑34917 or with third‑party API extensions that expose API functionality to low‑privileged users. Access control checks have been added to validate access to parent entities in the API modify methods.

Metadata

CVE ID
CVE-2026-44957
State
PUBLISHED
Assigner
hackerone
Reserved
2026-05-08 15:00 UTC
Published
2026-06-23 16:14 UTC
Last updated
2026-06-23 17:40 UTC
Primary CWE
CWE-284
CWE-284 Improper Access Control - Generic
Vendor / Product
Revive / Adserver
Sources
cve.org  ·  NVD

Severity & Metrics

4.3 MEDIUM CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
Revive Adserver — 0 ≤ 6.0.6
Weakness (CWE)
CWESourceDescription
CWE-284 cna CWE-284 Improper Access Control - Generic
CVSS scores (1)
ScoreSeverityVersionSourceVector
4.3 MEDIUM 3.0 cna CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References (1)
Back to overview