CVE-2026-68484
Sage AR Automation API has a serious authorization flaw that lets users with only low privileges create administrator accounts. This means a regular user can gain full control of the system. The vulnerability is considered critical.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Sage AR Automation API – no specific product versions are listed in the available data.
Real-world impact
An attacker who can log in with a normal account could create a new admin account and then use that account to access, modify, or delete any data in the system, effectively taking over the application.
Why this severity
The CVSS score of 9 reflects the combination of a high impact on confidentiality, integrity, and availability, and the fact that the vulnerability can be exploited by an authenticated user with low privileges. The score is high because the attacker can elevate privileges to full administrative control.
What to do about it
- ›Restrict low‑privileged users from accessing administrative functions in the Sage AR Automation API.
- ›Regularly audit user accounts to detect any newly created administrator accounts.
- ›Apply the principle of least privilege, ensuring users only have the permissions necessary for their role.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No official fix documented in the provided sources.