CVE-2026-67403

Deferred Deferred - Pending Action

Improper Authorization in Cash Collect Sage AR Automation API

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: HackerOne

Description

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-10

AI Q&A

2026-09-10

EPSS Evaluated

N/A

NVD

CVE-2026-67403

EUVD

EUVD-2026-75060

Affected Vendors & Products

Vendor	Product	Version / Range
sage	ar_automation_api	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Cash Collect has an improper authorization vulnerability in the Sage AR Automation API. Authenticated users can access administrative resources of other tenants by providing a valid but non-predictable tenant identifier due to insufficient tenant-level authorization checks.

Impact Analysis

This vulnerability allows unauthorized access to sensitive administrative data belonging to other tenants, potentially exposing confidential information, payment details, or system configurations. Attackers could manipulate or extract data without proper authorization.

Compliance Impact

The vulnerability allows unauthorized access to administrative resources across tenants, which could lead to data breaches or unauthorized data exposure. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) by failing to maintain proper access controls and tenant isolation.

Mitigation Strategies

Enable default Magic Link secured settings and authentication as recommended in the Sage AR Automation API updates. Ensure tenant-level authorization checks are enforced to prevent unauthorized access to administrative resources.

Hi! I’m here to help you understand CVE-2026-67403. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70