Dashboard / CVE-2026-44958

CVE-2026-44958

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 61/100
Published: 2026-06-23 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: None
I: Low
A: Low

Description

An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions. The status field has been removed from the hidden form fields in the banner edit screen.

Weakness Classification (1)

References & Advisories (1)

Bug Bounty Relevance

61 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

5.4 / 10.0 v3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

EPSS — Exploitation Probability

0.34%
Raw Score 0.003390
Percentile 27.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00339
2026-10-28
0.00339

Intelligence Sources

nvd ref →

External Links