Read the docs
TI-2023-14078 Aliases CVE-2023-29927GHSA-qw6r-773c-w64h

Versions of Sage 300 through 2022 implement role-based access controls that are only…

Priority MEDIUM 53CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-863.

Summary

Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Low-privileged Sage users, particularly those on a workstation setup in the "Windows Peer-to-Peer Network" or "Client Server Network" Sage 300 configurations, could recover the SQL connection strings being used by Sage 300 and interact directly with the underlying database(s) to create, update, and delete all company records, bypassing the program’s role-based access controls.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00402 34th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sage:sage_300:*:*:*:*:*:*:*:*up to 2022VulnerableSage
  • cpe:2.3:a:sage:sage_300:*:*:*:*:*:*:*:* Versions up to 2022 Vulnerable ·Sage

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-29927
  2. 2026-10-03 Alias added: GHSA-qw6r-773c-w64h

References

Advisory 1

  • TI-2022-18156 On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows… CVSS 3.1HIGH 7.8
  • TI-2022-19865 Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user… CVSS 3.1CRITICAL 9.8
  • TI-2022-19862 The optional Web Screens and Global Search features for Sage 300 through version 2022 use… CVSS 3.1CRITICAL 9.8
  • TI-2022-19864 The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded… CVSS 3.1HIGH 7.5
  • TI-2022-19863 The optional Global Search feature for Sage 300 through version 2022 uses a set of… CVSS 3.1HIGH 7.5
  • TI-2021-20579 In Sage 300 ERP (formerly accpac) through 6.8.x, the installer configures the… CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences