CVE-2025-48986

Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://hackerone.com/reports/3398283	Exploit Issue Tracking Third Party Advisory
https://hackerone.com/reports/3398283	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:revive-adserver:revive_adserver::::::::
	cpe:2.3:a:revive-adserver:revive_adserver::::::::

History

26 Sep 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) Omisión de autorización en Revive Adserver 5.5.2 y 6.0.1 y versiones anteriores provoca que un atacante autenticado cambie la dirección de correo electrónico de otros usuarios y potencialmente tome el control de sus cuentas utilizando la funcionalidad de recuperación de contraseña.

Information

Published : 2025-11-20 20:16

Updated : 2026-09-26 00:10

NVD link : CVE-2025-48986

Mitre link : CVE-2025-48986

CVE.ORG link : CVE-2025-48986

JSON object : View

Products Affected

revive-adserver

revive_adserver

CWE

CWE-284

Improper Access Control

{"id": "CVE-2025-48986", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-48986", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-20T21:38:45.725279Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "support@hackerone.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "Revive", "product": "Revive Adserver", "versions": [{"status": "affected", "version": "5", "versionType": "semver", "lessThanOrEqual": "5.5.2"}, {"status": "unaffected", "version": "5.5.3", "versionType": "semver", "lessThanOrEqual": "5.5.3"}, {"status": "unaffected", "version": "6.0.2", "versionType": "semver", "lessThanOrEqual": "6.0.2"}, {"status": "affected", "version": "6", "versionType": "semver", "lessThanOrEqual": "6.0.1"}]}]}], "published": "2025-11-20T20:16:22.407", "references": [{"url": "https://hackerone.com/reports/3398283", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "support@hackerone.com"}, {"url": "https://hackerone.com/reports/3398283", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality."}, {"lang": "es", "value": "Omisi\u00f3n de autorizaci\u00f3n en Revive Adserver 5.5.2 y 6.0.1 y versiones anteriores provoca que un atacante autenticado cambie la direcci\u00f3n de correo electr\u00f3nico de otros usuarios y potencialmente tome el control de sus cuentas utilizando la funcionalidad de recuperaci\u00f3n de contrase\u00f1a."}], "lastModified": "2026-09-26T00:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47AC2D81-BA0C-404A-B6F6-31151956D422", "versionEndIncluding": "5.5.2"}, {"criteria": "cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42E4B7BD-5F7B-4FBE-93D2-C19F30FA5A51", "versionEndIncluding": "6.0.1", "versionStartIncluding": "6.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}