CVE-2026-67403 — Sage / Sage AR Automation

CVE-2026-67403

Sage / Sage AR Automation PUBLISHED

Description (CNA)

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier.

Affected (CNA)

Vendor / product	Versions
Sage / Sage AR Automation	affected June-R1-2026 before June-R1-2026

CWE

CWE-639

References

https://helpcenter.sara.sage.com/hc/en-us/articles/52106283946651-June-R2-Release-2026

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.