CVE-2026-67403

Cash Collect's Sage AR Automation API contains an improper authorization flaw (CWE-639) in which tenant-level permission checks are not enforced when a tenant identifier is supplied. An authenticated, low-privileged user can pass a valid but otherwise non-predictable tenant identifier belonging to another tenant, and the API serves that tenant's administrative resources without verifying ownership; the high attack complexity in the CVSS 4.0 score reflects the need to know or obtain a valid tenant ID. Successful exploitation provides network-based, cross-tenant access to administrative resources with no user interaction or additional privileges, with high impact on the confidentiality, integrity, and availability of other tenants' data. Any organization running Cash Collect with the Sage AR Automation API enabled is potentially exposed, since the flaw is in multi-tenant access control rather than a specific code path; affected and fixed version ranges are not provided in the available data. There is currently no public proof-of-concept, the issue is not in CISA's KEV, and no in-the-wild exploitation is known.

What to do: Contact the vendor for a patched build and upgrade as soon as one is identified, since no fixed version is specified in the available data. In the meantime, audit Sage AR Automation API access logs for authenticated requests referencing tenant identifiers other than the caller's own (evidence of cross-tenant access), and restrict API access to the minimum necessary accounts while monitoring for anomalous tenant-ID usage.