CVE-2026-68486

Revive Adserver versions 6.0.8 and earlier are vulnerable to an authorization bypass during campaign-zone linking. The root cause is a missing campaign ownership check within the bulk-linking and single-link operations in zone-include.php, as well as the XML-RPC campaign-linking method. This allo...