Revive Adserver · Report #3883840
Cross-agency disclosure in website listing
Validstatus
mediumseverity
8upvotes
11 Nov 2026disclosed
Summary
Description
HackerOne community member Shmulik Cohen has reported an authorization bypass in website-index.php. A restricted manager could change the agencyid request parameter to view another agency's website listing, including website names, identifiers and timestamps. Detailed website pages continued to enforce ownership checks.
Resolution
The website listing now obtains the agency identifier from the authenticated account rather than the request.
Security advisory
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.