CVE-2026-67403
CriticalCVSS 9.0Summary
Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier.
Risk Assessment
An authenticated user can access administrative data and functions of other tenants, breaking tenant isolation and potentially leading to data leakage.
Recommendation
Upgrade Cash Collect to a version that fixes the tenant-level authorization issue. Additionally, strengthen access control mechanisms and regularly audit permissions.
Other vulnerabilities in Cash Collect
Original NVD description (English source)
Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier.