Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-44958 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions. The status field has been removed from the hidden form fields in the banner edit screen.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CNA: [email protected]CVSS-B:5.4 MEDIUMVector:CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://hackerone.com/reports/3678828	[email protected]	ExploitIssue TrackingTechnical DescriptionVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-284	Improper Access Control	[email protected]

Affected Products

Product	Versions
Revive Adserver	<= 6.0.6 (semver)
CPE cpe:2.3:a:revive-adserver:revive_adserver:::::::: Remediation No remediation found in references.

Change History

2 change records found show changes

Date	Action	Recorded By
Jun 23, 2026	CVE Modified	CISA-ADP
Jun 23, 2026	New CVE Received	[email protected]