Cross-agency delivery rule set creation

Summary

Description

HackerOne community members Shmulik Cohen and Dang Hung Vi independently reported an authorization bypass in 'channel-edit.php'. An authenticated manager could change the submitted agencyid parameter to create a delivery rule set belonging to another agency. The server trusted the submitted agency identifier when inserting the new rule set, allowing unauthorized creation of objects in another agency's account.

Resolution

New delivery rule sets now obtain their agency identifier from the authenticated account rather than submitted form data. The agency identifier has also been removed from the form's hidden fields.

Security advisory: https://www.revive-adserver.com/security/revive-sa-2026-004