CVE-2026-50744
Quick assessment
Affected
Revive Adserver
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
revive adserver是revive团队开源的一个广告服务器软件。 revive adserver 6.0.7版本存在权限许可和访问控制问题漏洞，该漏洞源于对XML‑RPC API管理限制的绕过问题，可通过ox.login方法泄露会话ID，导致未授权API调用。
Possible ATT&CK Techniques 1 AI
T1078.004 · Cloud Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-50744
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in the HTTP headers, and although the method correctly returned an error, the associated session was not invalidated. As a result, the leaked session ID could be used to perform subsequent API calls without restrictions.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
revive adserver 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
revive adserver是revive团队开源的一个广告服务器软件。 revive adserver 6.0.7版本存在权限许可和访问控制问题漏洞，该漏洞源于对XML‑RPC API管理限制的绕过问题，可通过ox.login方法泄露会话ID，导致未授权API调用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-50744
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-50744
请登录查看更多情报信息。
News Coverage for CVE-2026-50744 (1)
Same Patch Batch · Revive · 2026-06-26 · 6 CVEs total
| CVE-2026-50739 | revive adserver 权限许可和访问控制问题漏洞 | |
| CVE-2026-50742 | revive adserver 跨站脚本漏洞 | |
| CVE-2026-50745 | revive adserver 跨站脚本漏洞 | |
| CVE-2026-50741 | revive adserver 代码注入漏洞 | |
| CVE-2026-50740 | revive adserver 跨站脚本漏洞 |
IV. Related Vulnerabilities
Same weakness: CWE-284
-
CVE-2026-102795
Apache Traffic Server: SNI to Host header matching policy is -
CVE-2026-63045
Apache HTTP Server: mod_proxy_ftp PASV address handling -
CVE-2026-76142
Genians, Inc. Genian NAC/ZTNA Improper Access Control on the -
CVE-2026-103534
David-Crty databasement Snapshot Model snapshots SnapshotPol -
CVE-2026-102132
Kiteworks Core Privilege Escalation through Improper Access
V. Comments for CVE-2026-50744
No comments yet