# CVE-2026-107247: CVE-2026-107247

Status: published. Published: 2026-11-11. Updated: 2026-11-11.

An authorization bypass in Revive Adserver 6.0.0 through 6.0.8 allows an authenticated manager restricted to one agency to access or modify resources belonging to another agency. Global input registration gives GET parameters precedence over POST parameters, while submitted administration forms use POST values. By supplying authorized object identifiers in the query string and different identifiers in the POST body, an attacker can cause permission checks and subsequent operations to target different objects. This permits unauthorized cross-agency changes, campaign ownership reassignment and disclosure of campaign and banner data. The regression was introduced in commit 156dee7bc3283c128f35e5a31bb305054cc8de1b and is fixed in Revive Adserver 6.0.9 by restoring POST precedence in global input registration.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Revive / Adserver: ≥ 6.0.0; ≤ 6.0.8 (affected, semver). Source: CNA: hackerone

## Severity and prioritization

- CVSS 3.0: 8.1 (high); CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; source: CNA: hackerone

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-639

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://hackerone.com/reports/3831102 (CNA: hackerone)

## Provenance

- CNA: hackerone: https://www.cve.org/CVERecord?id=CVE-2026-107247; retrieved 2026-11-11; source updated 2026-11-11

Revision: 87904b0f6fdc70d6f1b0e9ce31f4e5faee93445f61cc0dd0d7f60b15c3180a9b

Canonical: https://y2.dev/cve/CVE-2026-107247

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.