What is CVE-2026-44958?

CVE-2026-44958 is a medium-severity vulnerability in Revive Adserver, classified under Improper Access Control. CVSS score: 5.4/10. Published 2026-06-23.

How severe is CVE-2026-44958?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Vulnerability in Revive Adserver

CVE-2026-44958

An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions. The status field has been removed from the hidden form fields in the banner edit screen.

EPSS: 0.003 (27.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.

Affected products

Revive Adserver — versions 0

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

support@hackerone.com

Frequently asked questions

What is CVE-2026-44958?: CVE-2026-44958 is a medium-severity vulnerability in Revive Adserver, classified under Improper Access Control. CVSS score: 5.4/10. Published 2026-06-23.
How severe is CVE-2026-44958?: Medium severity. CVSS v3 base score is 5.4 out of 10.