Revive Adserver 6.0.7 CSRF in zone-include.php (CVE-2026-50743) Advisory

Vulnerability Summary Vulnerability Overview Vulnerability Name: CSRF in zone-include.php allows unauthorized banner and campaign linking Vulnerability Type: Cross-Site Request Forgery (CSRF) Severity: Medium (5.4) CVE ID: CVE-2026-50743 Impact Scope Affected Version: Revive Adserver 6.0.7 Vulnerability Description: The script in Revive Adserver 6.0.7 contains a CSRF vulnerability. By crafting GET or POST requests, an attacker can perform operations to link or unlink banners or campaigns to zones on behalf of an authenticated administrator without validating CSRF tokens. Remediation Reporter: Althaf Shajahan (AnGrY) Report Date: June 4, 2026 Disclosure Date: June 25, 2026 Status: Resolved Timeline June 4, 2026: an_gr_y submitted a report to Revive Adserver. June 5, 2026: mbeccati (Revive Adserver staff) changed the status to "Triaged". June 8, 2026: kenjisbugz24 submitted a duplicate report and was invited to participate in this report. June 19, 2026: mbeccati (Revive Adserver staff) closed the report and changed the status to "Resolved". June 22, 2026: an_gr_y posted a comment. June 22, 2026: mbeccati (Revive Adserver staff) posted a comment. June 22, 2026: mbeccati (Revive Adserver staff) updated the CVE reference to CVE-2026-50743. June 23, 2026: mbeccati (Revive Adserver staff) posted a comment. June 23, 2026: an_gr_y posted a comment. June 23, 2026: mbeccati (Revive Adserver staff) posted a comment. June 23, 2026: an_gr_y posted a comment. June 23, 2026: mbeccati (Revive Adserver staff) posted a comment. Additional Information Reporter: an_gr_y Reported To: Revive Adserver Participants: an_gr_y, mbeccati, kenjisbugz24 Report List: #378585 Weakness: Cross-Site Request Forgery (CSRF) Bounty: None Retest: None Total Reward: None Account Details: None

Goal Reached Thanks to every supporter — we hit 100%!

Revive Adserver 6.0.7 CSRF in zone-include.php (CVE-2026-50743) Advisory