{"affected":[{"defaultStatus":"unaffected","product":"Adserver","source":"CNA: hackerone","vendor":"Revive","versions":[{"lessThanOrEqual":"6.0.8","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-68486","cwes":["CWE-639"],"description":"An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with zone-linking permissions, to associate another agency's campaign with their own zone. Campaign ownership checks are missing from the bulk-linking and single-link operations in zone-include.php and the XML-RPC campaign-linking method. Although agency filtering prevents foreign banners from being linked, the unauthorized association can expose the foreign campaign's name, type and identifier in the linked-campaign listing. The issue is fixed in Revive Adserver 6.0.9 by validating campaign ownership in the affected operations.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.4,"severity":"medium","source":"CNA: hackerone","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.0"}],"modifiedAt":1794418237743,"publishedAt":1794418237743,"references":[{"source":"CNA: hackerone","tags":[],"url":"https://hackerone.com/reports/3958112"}],"remediation":[],"revision":"74b7a298098d9a9706ea92a2a1a865a91dffe85152d93c6472e2b17a53998383","sources":[{"modifiedAt":1794418237743,"name":"CNA: hackerone","retrievedAt":1794421554121,"url":"https://www.cve.org/CVERecord?id=CVE-2026-68486"}],"ssvc":null,"status":"published","title":"CVE-2026-68486","updatedAt":1794421554121}