CVE-2026-67403: Sage Sage AR Automation API vulnerability
Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the Sage AR Automation API and possess or obtain a valid tenant identifier for another tenant. The tenant identifier is described as non-predictable, so exploitation depends on access to a valid identifier rather than simple enumeration.
What resources may be exposed?
Authenticated users may access administrative resources that belong to other tenants because tenant-level authorization checks are insufficient.
How can an organization determine whether it is affected?
Review Sage AR Automation API access controls and test whether an authenticated user associated with one tenant can request administrative resources for a different tenant using that tenant's valid identifier.