CVE-2026-44958CWE-284

An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions…

Medium · published June 23, 2026

CVSS v3.0
5.4
EPSS
0%
Percentile
26.1
In the wild
Unconfirmed
What it is

An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions. The status field has been removed from the hidden form fields in the banner edit screen.

The record
Technical detail
CVSS v3.0
5.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00339 · 26.1th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-06-23T16:14Z
EPSS history
Timeline
  • 23 JUN 16:14Z
    An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions…
    cvelistv5