The vulnerability is a classic access control flaw that permits users with only advertiser‑level privileges to change the status of a banner, turning it on or off, despite lacking the required permissions. This is achieved through the banner-edit.php script, which updates a banner’s status based solely on edit permissions and ignores whether the status field is hidden in the form. The weakness lies in missing or improperly validated authorization checks, as identified by CWE‑284.

Revive Adserver versions 6.0.6 and all earlier releases are affected. The issue is specific to the banner editing functionality exposed by the vendor’s web interface.

The CVSS assessment assigns a score of 5.4, indicating a moderate impact that could be leveraged by a legitimate advertiser to alter campaign delivery without proper approval. No EPSS value is available, and the vulnerability is not listed in CISA’s KEV catalogue. Based on the description, the likely attack vector is remote over the web interface, requiring only authenticated use of the advertiser account and no exploitation of external services.