An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with zone-linking permissions, to associate another agency's campaign with their own zone. Campaign ownership checks are missing from the bulk-linking and single-link operations in zone-include.php and the XML-RPC campaign-linking method. Although agency filtering prevents foreign banners from being linked, the unauthorized association can expose the foreign campaign's name, type and identifier in the linked-campaign listing. The issue is fixed in Revive Adserver 6.0.9 by validating campaign ownership in the affected operations.

Affected: unknown Revive Adserver Vulnerabilities

======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-004 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-004 ------------------------------------------------------------------------ Date: 2026-11-11 Risk Level: Medium to High Applications affected: Revive Adserver Versions affected: <= 6.0.8 Versions not affected: >= 6.0.9 Website: https://www.revive-adserver.com/ ========================================================================

======================================================================== 1. Blind SQL injection through inconsistent request precedence ======================================================================== Vulnerability Type: CWE-89: SQL Injection CVE-ID: CVE-2026-107662 Risk level: High CVSS Base Score: 8.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ------------------------------------------------------------------------

Description -----------

Resolution ----------

References ---------- https://hackerone.com/reports/3896779 https://github.com/revive-adserver/revive-adserver/commit/e301dbbb7 https://github.com/revive-adserver/revive-adserver/commit/0aa9d0124 https://cwe.mitre.org/data/definitions/89.html

========================================================…

An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with zone-linking permissions, to associate another agency's campaign with their own zone. Campaign ownership checks are missing from the bulk-linking and single-link operations in zone-include.php and the XML-RPC campaign-linking method. Although agency filtering prevents foreign banners from being linked, the unauthorized association can expose the foreign campaign's name, type and identifier in the linked-campaign listing. The issue is fixed in Revive Adserver 6.0.9 by validating campaign ownership in the affected operations.