Revive Adserver XML-RPC API Missing Access Control (CVE-2026-44957)

Vulnerability Overview Vulnerability Name: Missing access control when modifying parent entities via XML-RPC Reporter: HackerOne community member barcrange (314) Report Date: April 16, 2026, 9:24 AM UTC Severity: Medium (4.3) CVE ID: CVE-2026-44957 Impact Scope Affected Systems: Revive Adserver versions 6.0.5 and earlier Vulnerability Description: In Revive Adserver's XML-RPC API, there is a lack of access control checks when modifying parent entities. The API allows entities to be reassigned to different parent entities, leading to inconsistencies in ownership relationships. This issue is exploitable by low-privilege users only when combined with CVE-2026-34917 or when using third-party API extensions to leverage API functionalities. Remediation Remediation Measure: Access control checks have been added to verify permissions for modifying parent entities within the API. Fix Status: Resolved Disclosure Date: June 3, 2026, 1:32 PM UTC Timeline April 16, 2026, 9:24 AM UTC: 314 submitted the report to Revive Adserver. April 16, 2026, 9:13 AM UTC: mbecatti (Revive Adserver employee) closed the report and changed the status to Informative. April 16, 2026, 3:39 PM UTC: mbecatti reopened the report. April 17, 2026, 1:27 PM UTC: 314 left a comment. April 17, 2026, 2:31 PM UTC: mbecatti left a comment. April 17, 2026, 2:36 PM UTC: mbecatti left a comment. April 19, 2026, 5:28 PM UTC: mbecatti changed the status to Triage. April 24, 2026, 6:41 AM UTC: v3rtical submitted a duplicate report (#3692514) and was invited to collaborate on this report. May 18, 2026, 3:00 PM UTC: mbecatti left a comment. May 22, 2026, 1:59 PM UTC: mbecatti closed the report and changed the status to Resolved. May 22, 2026, 2:01 PM UTC: mbecatti changed the severity from None to Medium (4.3). Additional Information Report ID: #3627376 Participants: 314, mbecatti, v3rtical Reward: None Account Details: None Summary This vulnerability involves a missing access control issue in the XML-RPC API of Revive Adserver versions 6.0.5 and earlier, which could allow low-privilege users to perform unauthorized operations. The remediation measure involved adding access control checks, and the issue has been resolved.

Goal Reached Thanks to every supporter — we hit 100%!

Revive Adserver XML-RPC API Missing Access Control (CVE-2026-44957)