Revive Adserver up to 6.0.8 Linking zone-include.php authorization

Summaryinfo

A vulnerability classified as problematic has been found in Revive Adserver up to 6.0.8. This vulnerability affects unknown code of the file zone-include.php of the component Linking. This manipulation causes authorization. The identification of this vulnerability is CVE-2026-68486. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Revive Adserver up to 6.0.8. Affected by this vulnerability is some unknown processing of the file zone-include.php of the component Linking. The manipulation with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with zone-linking permissions, to associate another agency's campaign with their own zone. Campaign ownership checks are missing from the bulk-linking and single-link operations in zone-include.php and the XML-RPC campaign-linking method. Although agency filtering prevents foreign banners from being linked, the unauthorized association can expose the foreign campaign's name, type and identifier in the linked-campaign listing. The issue is fixed in Revive Adserver 6.0.9 by validating campaign ownership in the affected operations.

The advisory is shared at hackerone.com. This vulnerability is known as CVE-2026-68486 since 07/30/2026. The exploitation appears to be easy. The attack can be launched remotely. Additional levels of successful authentication are needed for exploitation. Technical details are known, but no exploit is available.

By approaching the search of inurl:zone-include.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 6.0.9 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Advertising Software

Vendor

• Revive

Name

• Adserver

Version

• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6
• 6.0.7
• 6.0.8

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion