CVE-2026-67403
The vulnerability is an improper authorization flaw in the Sage AR Automation API (Cash Collect). Authenticated users can bypass tenant‑level checks and access administrative resources of other tenants by supplying a valid tenant identifier.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Sage AR Automation API (Cash Collect) – all users of the API without a specific version restriction.
Real-world impact
An attacker who is logged in can read or modify sensitive administrative data belonging to other tenants, potentially exposing confidential information or disrupting business operations.
Why this severity
The CVSS score of 9 reflects the combination of high confidentiality, integrity, and availability impact across all vectors, coupled with the fact that the flaw is exploitable by authenticated users with low privilege.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources