Critical severityNVD Advisory· Published Sep 9, 2026

CVE-2026-67403

Description

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier.

Affected products

Sage/Cash Collectllm-create
Sage/AR Automation APIllm-fuzzy

Patches

Vulnerability mechanics

References

helpcenter.sara.sage.com/hc/en-us/articles/52106283946651-June-R2-Release-2026nvd

News mentions

No linked articles in our index yet.

cvss	0.585
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000