What is GHSA-hqvw-xvc4-mxq4?

GHSA-hqvw-xvc4-mxq4 is a security advisory published by GitHub Security Advisories with Medium severity. An access control bypass allows an advertiser‑level user to activate or deactivate a banner in...

Which CVE IDs does GHSA-hqvw-xvc4-mxq4 cover?

GHSA-hqvw-xvc4-mxq4 covers the following CVE IDs: CVE-2026-44958. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hqvw-xvc4-mxq4?

GHSA-hqvw-xvc4-mxq4 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-hqvw-xvc4-mxq4MediumCVSS 5.4

An access control bypass allows an advertiser‑level user to activate or deactivate a banner in...

Vendor

GitHub Security Advisories

Published

June 23, 2026

Last Modified

June 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-44958 →

📋 Description

An access control bypass allows an advertiser‑level user to activate or deactivate a banner in Revive Adserver 6.0.6 and earlier, even when such permissions were not granted. The banner-edit.php script allowed the banner status to be overwritten solely based on banner edit permissions. The status field has been removed from the hidden form fields in the banner edit screen.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-44958
https://hackerone.com/reports/3678828
https://github.com/advisories/GHSA-hqvw-xvc4-mxq4