[REVIVE-SA-2026-004] Revive Adserver Vulnerabilities
Matteo Beccati ·
======================================================================== Revive Adserver Security Advisory REVIVE-SA-2026-004 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2026-004 ------------------------------------------------------------------------ Date: 2026-11-11 Risk Level: Medium to High Applications affected: Revive Adserver Versions affected: <= 6.0.8 Versions not affected: >= 6.0.9 Website: https://www.revive-adserver.com/ ======================================================================== ======================================================================== 1. Blind SQL injection through inconsistent request precedence ======================================================================== Vulnerability Type: CWE-89: SQL Injection CVE-ID: CVE-2026-107662 Risk level: High CVSS Base Score: 8.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3896779 https://github.com/revive-adserver/revive-adserver/commit/e301dbbb7 https://github.com/revive-adserver/revive-adserver/commit/0aa9d0124 https://cwe.mitre.org/data/definitions/89.html ======================================================================== 2. Authorization bypass through inconsistent request precedence ======================================================================== CVE-ID: CVE-2026-107247 Risk level: High CVSS Base Score: 8.1 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3831102 https://github.com/revive-adserver/revive-adserver/commit/e301dbbb7 https://github.com/revive-adserver/revive-adserver/commit/156dee7bc https://cwe.mitre.org/data/definitions/639.html ======================================================================== 3. Reflected XSS in conversion statistics ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-108558 Risk level: Medium CVSS Base Score: 6.1 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3878649 https://github.com/revive-adserver/revive-adserver/commit/b9fd9b04b https://cwe.mitre.org/data/definitions/79.html ======================================================================== 4. Reflected XSS in iframe invocation dimensions ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-108559 Risk level: Medium CVSS Base Score: 6.1 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3908050 https://github.com/revive-adserver/revive-adserver/commit/9643f44dc https://cwe.mitre.org/data/definitions/79.html ======================================================================== 5. Unauthenticated reflected XSS in update history ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-108560 Risk level: Medium CVSS Base Score: 6.1 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/4075098 https://github.com/revive-adserver/revive-adserver/commit/770130171 https://github.com/revive-adserver/revive-adserver/commit/8c449079d https://cwe.mitre.org/data/definitions/79.html ======================================================================== 6. Session-stored XSS in report date selection ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-108561 Risk level: Medium CVSS Base Score: 6.1 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/4116433 https://github.com/revive-adserver/revive-adserver/commit/cce8a4081 https://cwe.mitre.org/data/definitions/79.html ======================================================================== 7. Stored XSS in tracker maintenance ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-108562 Risk level: Medium CVSS Base Score: 5.4 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3826207 https://github.com/revive-adserver/revive-adserver/commit/ae0bbc4b3 https://cwe.mitre.org/data/definitions/79.html ======================================================================== 8. Campaign-zone linking without ownership validation ======================================================================== CVE-ID: CVE-2026-68486 Risk level: Medium CVSS Base Score: 5.4 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3958112 https://github.com/revive-adserver/revive-adserver/commit/8fc49ab1d https://github.com/revive-adserver/revive-adserver/commit/f0ab01a02 https://cwe.mitre.org/data/definitions/639.html ======================================================================== 9. Formula injection in conversion-report XLS exports ======================================================================== Vulnerability Type: CWE-94: Code Injection CVE-ID: CVE-2026-108563 Risk level: Medium CVSS Base Score: 4.7 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3859000 https://github.com/revive-adserver/revive-adserver/commit/1e4d48b18 https://cwe.mitre.org/data/definitions/94.html ======================================================================== 10. Reflected XSS in direct-selection invocation options ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-108564 Risk level: Medium CVSS Base Score: 4.7 CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3942028 https://github.com/revive-adserver/revive-adserver/commit/cb8fdeddf https://cwe.mitre.org/data/definitions/79.html ======================================================================== 11. Reflected XSS in popup invocation options ======================================================================== Vulnerability Type: CWE-79: Cross-site Scripting CVE-ID: CVE-2026-108565 Risk level: Medium CVSS Base Score: 4.7 CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3971985 https://github.com/revive-adserver/revive-adserver/commit/2275165e0 https://cwe.mitre.org/data/definitions/79.html ======================================================================== 12. Cross-agency website-list disclosure ======================================================================== CVE-ID: CVE-2026-68485 Risk level: Medium CVSS Base Score: 4.3 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3883840 https://github.com/revive-adserver/revive-adserver/commit/42df0608e https://cwe.mitre.org/data/definitions/639.html ======================================================================== 13. Cross-agency delivery rule set creation ======================================================================== CVE-ID: CVE-2026-82978 Risk level: Medium CVSS Base Score: 4.3 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3929216 https://hackerone.com/reports/3883840 https://github.com/revive-adserver/revive-adserver/commit/cabeb2e53 https://cwe.mitre.org/data/definitions/639.html ======================================================================== 14. Cross-site request forgery in tracker invocation ======================================================================== Vulnerability Type: CWE-352: Cross-Site Request Forgery CVE-ID: CVE-2026-77168 Risk level: Medium CVSS Base Score: 4.3 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N ------------------------------------------------------------------------ Description ----------- Resolution ---------- References ---------- https://hackerone.com/reports/3981932 https://github.com/revive-adserver/revive-adserver/commit/a4593a679 https://cwe.mitre.org/data/definitions/352.html ======================================================================== Solution ======================================================================== ======================================================================== Contact Information ======================================================================== The security contact for Revive Adserver can be reached at: <security AT revive-adserver DOT com>. Please review https://www.revive-adserver.com/security/ before doing so. -- Matteo Beccati On behalf of the Revive Adserver Team https://www.revive-adserver.com/ _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/