CVE-2026-44957

A missing access control check when invoking various modify methods in the XML‑RPC API of Revive Adserver 6.0.6 and earlier. The API allowed entities to be reassigned to different parent entities, leading to inconsistent ownership relationships. This issue was exploitable only in combination with CVE‑2026‑34917 or with third‑party API extensions that expose API functionality to low‑privileged users. Access control checks have been added to validate access to parent entities in the API modify methods.

• CWE-284

• https://hackerone.com/reports/3677576

Published

Jun 23, 2026

Last Modified

Jun 23, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44947A missing clean-up in the legacy Project Role Template Bindi…6.9
• CVE-2026-44948A path traversal vulnerability was found in Fleet's ImageSca…5.3
• CVE-2026-44949A Rancher FleetWorkspace admission path allowed side effects…7
• CVE-2026-4495A security flaw has been discovered in atjiu pybbs 6.0.0. Th…3.5
• CVE-2026-44955Pronetiqs IntraVUE versions 3.2.1a14 and prior have an expos…6.9
• CVE-2026-44956Low‑privileged users could use their Full Name as a vector f…0
• CVE-2026-44958An access control bypass allows an advertiser‑level user to …5.4
• CVE-2026-44959A missing validation of user input exists when saving delive…8.8
• CVE-2026-4496A vulnerability was found in sigmade Git-MCP-Server up to 78…5.3
• CVE-2026-44960A stored XSS can be exploited by leveraging the usernames as…0
• CVE-2026-44961The XML‑RPC API addUser method has a validation bypass intro…0
• CVE-2026-44962Plesk contains an XPath injection vulnerability in the APS A…9.9