CVE-2026-50743
Received Received - Intake

CSRF in Revive Adserver Zone Management

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: HackerOne

Description
A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered via crafted GET or POST requests without any verification of the CSRF token, allowing an attacker to perform these actions on behalf of an authenticated administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-50743
EUVD
EUVD-2026-46027

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
revive_adserver revive_adserver 6.0.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Request Forgery (CSRF) vulnerability in Revive Adserver 6.0.7. It exists in the zone-include.php script where actions like linking or unlinking banners or campaigns to zones can be performed via crafted GET or POST requests without verifying the CSRF token. This allows attackers to execute these actions on behalf of an authenticated administrator without their knowledge.

Detection Guidance

To detect this CSRF vulnerability in Revive Adserver 6.0.7, inspect network traffic for requests to zone-include.php that modify banner or campaign zones without a valid CSRF token. Check server logs for unusual GET or POST requests targeting this script. Use tools like Burp Suite or OWASP ZAP to intercept and analyze requests for missing CSRF token validation.

Impact Analysis

An attacker could trick an authenticated administrator into clicking a malicious link or visiting a compromised website. This would allow the attacker to manipulate ad server configurations, potentially linking or unlinking banners or campaigns without the administrator's consent. This could disrupt ad delivery or lead to unauthorized changes in ad targeting.

Compliance Impact

This CSRF vulnerability could allow unauthorized changes to ad server configurations, potentially affecting data integrity and access controls. For GDPR, it may impact data processing integrity and user consent mechanisms. For HIPAA, it could compromise protected health information handling if ad server configurations are altered without proper authorization.

Mitigation Strategies

Immediately upgrade Revive Adserver to the latest version where this vulnerability is patched. If upgrading is not possible, implement server-side CSRF token validation for zone-include.php requests. Restrict access to administrative functions via IP whitelisting or VPN. Monitor logs for suspicious activity related to zone modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-50743. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart