CVE-2026-44957

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 6.0.7

Description A missing access control check exists when invoking various modify methods in the XML-RPC API. This allows entities to be reassigned to different parent entities, resulting in inconsistent ownership relationships. This issue is exploitable when combined with other vulnerabilities or third-party API extensions that expose API functionality to low-privileged users.

Recommendations Update to a version later than 6.0.6 to ensure access control checks are in place to validate access to parent entities in the API modify methods.