This vulnerability in Revive Adserver versions 6.0.6 and earlier involves improper access control (CWE-284) where an advertiser-level user can bypass intended permission restrictions to change the activation status of banners. The banner-edit.php script incorrectly allowed the status field to be overwritten based on banner edit permissions alone, enabling unauthorized status changes. The fix involved removing the status field from hidden form fields to prevent this unauthorized modification.

An attacker with advertiser-level privileges can modify the activation status of banners without having explicit permission to do so. This could lead to unauthorized changes in banner display, potentially disrupting advertising campaigns or causing denial of service by deactivating banners. The vulnerability does not impact confidentiality but affects integrity and availability of banner status.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has indicated that the status field was removed from hidden form fields in the banner edit screen, which suggests a code-level fix has been implemented. Users should monitor the official Revive project advisories for an official patch or update. Until then, restrict advertiser-level permissions carefully and consider additional access controls as a temporary measure.