The vulnerability is a missing access control check in the zone-include.php script and its API. A low‑privileged user can link zones to banners or campaigns belonging to other managers on the same Revive Adserver instance, creating inconsistent ownership relationships. This can lead to confusion over content ownership and may allow unauthorized manipulation of advertising resources.

The flaw affects Revive Adserver versions 6.0.6 and earlier. Any deployment using these releases is susceptible until the ownership validation has been added.

The CVSS score of 4.3 indicates a medium impact, and the lack of an EPSS score or KEV listing suggests the risk is moderate. Exploitation requires an authenticated user with low privileges on the same instance, and the attacker must use the zone-include.php page or API to perform the linking. As the issue is constrained to internal users and does not provide code execution or privilege escalation, the overall threat remains limited but non‑negligible.