# CVE-2026-107247: Revive Adserver authorization bypass across agencies

Source: https://junglewise.ai/threats/cve-2026-107247-an-authorization-bypass-in-revive-adserver-6-0-0-through-6-0-8  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-11. Updated: 2026-11-11  
License: CC BY 4.0 with a link back

CVE-2026-107247 · Severity: high · CVSS 8.1 · Published 2026-11-11

Revive Adserver is an ad management platform that controls who can access and modify advertising campaigns and banners for different agencies. This flaw allows a manager assigned to one agency to access, modify, or steal data from campaigns belonging to other agencies by exploiting how the application processes web form data. An attacker could reassign campaigns, steal campaign performance data, or sabotage competitor advertising.

Technologies: [Revive Adserver](https://junglewise.ai/threats/technologies/revive-adserver-1). Vendors: [Revive](https://junglewise.ai/threats/vendors/revive).

## Quick answers

**Is CVE-2026-107247 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107247 being exploited in the wild.

**How severe is CVE-2026-107247?** High severity, with a CVSS score of 8.1, published 11 November 2026.

**Which products and versions are affected?** Revive Adserver 6.0.0 through 6.0.8.

**Is there a fix for CVE-2026-107247?** Yes: fixed in Revive Adserver 6.0.9. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107247 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-107247?** Check whether you run Revive Adserver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Revive Adserver 6.0.9

## Technical details

The vulnerability is an authorization bypass caused by a parameter precedence regression in global input registration. Authenticated users can supply object identifiers in the GET query string while submitting different identifiers in the POST body; permission checks use the GET value but subsequent operations use the POST value, causing the application to operate on unintended objects. This affects cross-agency resource access and modification in versions 6.0.0–6.0.8.

## Affected products

- Revive Adserver 6.0.0 through 6.0.8

## Timeline

- 2026-11-11: disclosed

## References

- [https://hackerone.com/reports/3831102](https://hackerone.com/reports/3831102)

## Related threats

- [Revive Adserver authorization bypass in channel-edit.php](https://junglewise.ai/threats/cve-2026-82978-an-authorization-bypass-in-channel-edit-php-in-revive-adserver-6)
- [Revive Adserver CSRF in tracker modification](https://junglewise.ai/threats/cve-2026-77168-a-cross-site-request-forgery-vulnerability-in-tracker-invocation)
- [Revive Adserver authorization bypass in campaign-zone linking](https://junglewise.ai/threats/cve-2026-68486-an-authorization-bypass-in-campaign-zone-linking-in-revive)
- [Revive Adserver authorization bypass in website listing](https://junglewise.ai/threats/cve-2026-68485-an-authorization-bypass-in-website-index-php-in-revive-adserver-6)
- [Revive Adserver reflected cross-site scripting in popup options](https://junglewise.ai/threats/cve-2026-108565-a-reflected-cross-site-scripting-vulnerability-in-the-popup)