CVE-2025-52669

Published: Nov 20, 2025Modified: Jun 17, 2026

4.3

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: support@hackerone.com (Secondary)

Description

Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes non-admin users to have access to the contact name and email address of other users on the system.

Affected (2)

Products: Revive Adserver: Revive Adserver

Revive Adserver

1 product

Revive Adserver

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Revive Adserver Revive Adserver	Up to 5.5.2
Revive Adserver Revive Adserver	From 6.0.0 to 6.0.1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://hackerone.com/reports/3401464

Source: support@hackerone.com

ExploitIssue TrackingThird Party Advisory

https://hackerone.com/reports/3401464

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.