CVE-2026-68484
CriticalCVSS 9.0Summary
Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privileges.
Risk Assessment
An authenticated low-privileged user can escalate privileges to administrator, potentially leading to unauthorized access to sensitive data and system functions.
Recommendation
Upgrade Cash Collect to a version that fixes the authorization issue. Additionally, perform a privilege audit and restrict access to administrative functions.
Other vulnerabilities in Cash Collect
Original NVD description (English source)
Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privileges.