{"api_version":"1","generated_at":"2026-10-22T11:33:09+00:00","cve":"CVE-2025-48986","urls":{"html":"https://cve.report/CVE-2025-48986","api":"https://cve.report/api/cve/CVE-2025-48986.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-48986","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-48986"},"summary":{"title":"CVE-2025-48986","description":"Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.","state":"PUBLISHED","assigner":"hackerone","published_at":"2025-11-20 20:16:22","updated_at":"2026-09-26 00:10:00"},"problem_types":["CWE-284","CWE-284 CWE-284 Improper Access Control"],"metrics":[{"version":"3.0","source":"support@hackerone.com","type":"Secondary","score":"8.8","severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.0","source":"CNA","type":"DECLARED","score":"8.8","severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.0"}}],"references":[{"url":"https://hackerone.com/reports/3398283","name":"https://hackerone.com/reports/3398283","refsource":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Issue Tracking","Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-48986","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-48986","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Revive","product":"Revive Adserver","version":"affected 5 5.5.2 semver","platforms":[]},{"source":"CNA","vendor":"Revive","product":"Revive Adserver","version":"unaffected 5.5.3 5.5.3 semver","platforms":[]},{"source":"CNA","vendor":"Revive","product":"Revive Adserver","version":"unaffected 6.0.2 6.0.2 semver","platforms":[]},{"source":"CNA","vendor":"Revive","product":"Revive Adserver","version":"affected 6 6.0.1 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"48986","vulnerable":"1","versionEndIncluding":"5.5.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"revive-adserver","cpe5":"revive_adserver","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"48986","vulnerable":"1","versionEndIncluding":"6.0.1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"revive-adserver","cpe5":"revive_adserver","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"48986","cve":"CVE-2025-48986","epss":"0.006240000","percentile":"0.478170000","score_date":"2026-09-27","updated_at":"2026-09-28 00:02:20"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-48986","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-11-20T21:38:45.725279Z","version":"2.0.3"},"type":"ssvc"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-284","description":"CWE-284 Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-11-20T21:38:49.611Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"references":[{"tags":["exploit"],"url":"https://hackerone.com/reports/3398283"}],"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"product":"Revive Adserver","vendor":"Revive","versions":[{"lessThanOrEqual":"5.5.2","status":"affected","version":"5","versionType":"semver"},{"lessThanOrEqual":"5.5.3","status":"unaffected","version":"5.5.3","versionType":"semver"},{"lessThanOrEqual":"6.0.2","status":"unaffected","version":"6.0.2","versionType":"semver"},{"lessThanOrEqual":"6.0.1","status":"affected","version":"6","versionType":"semver"}]}],"descriptions":[{"lang":"en","value":"Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality."}],"metrics":[{"cvssV3_0":{"baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.0"}}],"providerMetadata":{"dateUpdated":"2025-11-20T19:11:36.449Z","orgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","shortName":"hackerone"},"references":[{"url":"https://hackerone.com/reports/3398283"}]}},"cveMetadata":{"assignerOrgId":"36234546-b8fa-4601-9d6f-f4e334aa8ea1","assignerShortName":"hackerone","cveId":"CVE-2025-48986","datePublished":"2025-11-20T19:11:36.449Z","dateReserved":"2025-05-29T15:00:04.775Z","dateUpdated":"2025-11-20T21:38:49.611Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-11-20 20:16:22","lastModifiedDate":"2026-09-26 00:10:00","problem_types":["CWE-284","CWE-284 CWE-284 Improper Access Control"],"metrics":{"cvssMetricV30":[{"source":"support@hackerone.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-11-20T21:38:45.725279Z","id":"CVE-2025-48986","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*","versionEndIncluding":"5.5.2","matchCriteriaId":"47AC2D81-BA0C-404A-B6F6-31151956D422"},{"vulnerable":true,"criteria":"cpe:2.3:a:revive-adserver:revive_adserver:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndIncluding":"6.0.1","matchCriteriaId":"42E4B7BD-5F7B-4FBE-93D2-C19F30FA5A51"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"48986","Ordinal":"1","Title":"CVE-2025-48986","CVE":"CVE-2025-48986","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"48986","Ordinal":"1","NoteData":"Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change other users' email address and potentialy take over their accounts using the forgot password functionality.","Type":"Description","Title":"CVE-2025-48986"}]}}}