CVE-2025-52670CWE-639CWE-862broken-access-control

CVE-2025-52670

Medium · published November 21, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
26.8
In the wild
Unconfirmed
What it is

Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00345 · 26.8th percentile
Weaknesses
CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-862 · Missing Authorization
Published
2025-11-21T01:16Z
Affected products (2)
ProductVersionsFixed in
revive-adserver/revive_adserver≤ 5.5.2—
revive-adserver/revive_adserver≥ 6.0.0, ≤ 6.0.1—
References (1)
https://hackerone.com/reports/3401612 · [email protected]
EPSS history
Timeline
  • 20 NOV 19:10Z
    Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts
    cvelistv5