Read the docs
TI-2026-47688 Aliases CVE-2026-67403GHSA-xwrh-qw65-q9mr

Authorization bypass in Sage AR Automation

Priority MEDIUM 40CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00271 19th percentileScored 2026-11-07
Fix Fixed Sage AR Automation (Sage): June-R1-2026

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SageSage AR AutomationJune-R1-2026 to before June-R1-2026June-R1-2026Patch availableCNA
  • Sage AR Automation VendorSage Affected June-R1-2026 to before June-R1-2026 Fixed in June-R1-2026 Patch available CNA

Remediation

  • Fix · CNA Sage AR Automation (Sage) Fixed in June-R1-2026

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Sage AR Automation June-R1-2026

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2026-48261 Missing authorization in Sage AR AutomationPriority MEDIUM 40
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-67403
  2. 2026-10-03 Alias added: GHSA-xwrh-qw65-q9mr

References

Other 1

  • TI-2020-05970 Sage X3 AdxAdmin Unauthenticated Command Execution Bypass by Spoofing CVSS 3.1CRITICAL 10.0
  • TI-2022-15233 Multiple XSS issues were discovered in Sage Enterprise Intelligence 2021 R1.1 that allow… CVSS 3.1CRITICAL 9.0
  • TI-2022-15235 Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated… CVSS 3.1HIGH 8.8
  • TI-2019-15193 A path traversal vulnerability exists in Sage FRP 1000 before November 2019. CVSS 3.1HIGH 7.5
  • TI-2022-18156 On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows… CVSS 3.1HIGH 7.8
  • TI-2022-15234 Multiple XSS issues were discovered in Sage XRT Business Exchange 12.4.302 that allow an… CVSS 3.1MEDIUM 5.4
See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences