Revive Adserver · Report #3678828
Banner status override by advertiser‑level users
Validstatus
mediumseverity
5upvotes
3 Jun 2026disclosed
Summary
HackerOne community member V3rtical has reported an access control bypass allowing an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions.
The status field has been removed from the hidden form fields in the banner edit screen.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.