Missing authorization in the zone-include.php script and the public API allows an authenticated user with low privileges to link banners or campaigns to zones that belong to other manager accounts on the same Revive Adserver instance. This flaw creates inconsistent ownership records, potentially leading to disputes over content ownership and confusion in management. The vulnerability does not grant code execution or privilege escalation, but it undermines data integrity and accountability.

The issue applies to Revive Adserver 6.0.6 and all earlier releases. Any deployment still running those versions is vulnerable until the ownership validation has been applied or the software has been updated to a newer version that includes the fix.

The CVSS score of 4.3 indicates a medium impact. The lack of EPSS data and absence from the KEV catalog suggest exploitation is unlikely but still possible. An attacker must authenticate as a low‑privileged manager on the same instance and use the zone‑include.php page or API to perform the link, so the threat is limited to internal users. Nevertheless, consistent ownership records are important for operational integrity, and the vulnerability can facilitate misattribution of content.