Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-44957 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier. The API allowed entities to be reassigned to different parent entities, leading to inconsistent ownership relationships. This issue was exploitable only in combination with CVE‑2026‑34917 or with third‑party API extensions that expose API functionality to low‑privileged users. Access control checks have been added to validate access to parent entities in the API modify methods.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:3.1 LOWVector:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

CNA: [email protected]CVSS-B:4.3 MEDIUMVector:CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://hackerone.com/reports/3677576	[email protected]	Issue TrackingTechnical DescriptionVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-284	Improper Access Control	[email protected]

Affected Products

Product	Versions
Revive Adserver	<= 6.0.6 (semver)
CPE cpe:2.3:a:revive-adserver:revive_adserver:::::::: Remediation No remediation found in references.

Change History

2 change records found show changes

Date	Action	Recorded By
Jun 23, 2026	CVE Modified	CISA-ADP
Jun 23, 2026	New CVE Received	[email protected]