CVE-2026-68484

Cash Collect contains an improper authorization flaw (CWE-862) in its Sage AR Automation API, where administrative functions fail to verify the caller's user privileges. An authenticated low-privileged user can invoke these administrative functions over the network and, because permission checks are missing, create new administrator accounts. By creating an admin account, the attacker elevates their privileges to full administrative control, consistent with the critical CVSS 4.0 score of 9 and high impact across confidentiality, integrity, and availability. Any organization running Cash Collect with the Sage AR Automation API and low-privileged user accounts is exposed, though the specific affected version range is not stated in the available disclosure data. Exploitation is not known in the wild: the issue is not in CISA's KEV catalog and no public proof-of-concept is available.

What to do: Contact the Cash Collect vendor to identify the fixed release and upgrade promptly, as no patched version numbers are included in the available data. In the interim, restrict access to the Sage AR Automation API, audit existing user accounts for recently created or unauthorized administrators, and limit how many low-privileged accounts can reach the API.