CVE-2026-67403: Cash Collect Auth Bypass Vulnerability

CVE-2026-67403 Overview

CVE-2026-67403 is an improper authorization vulnerability in the Sage AR Automation API used by Cash Collect. The flaw stems from insufficient tenant-level authorization checks [CWE-639]. Authenticated users can access administrative resources belonging to other tenants by supplying a valid non-predictable tenant identifier. The issue breaks the multi-tenant isolation model that separates customer data in the Software-as-a-Service (SaaS) platform.

Critical Impact
Authenticated attackers can enumerate or manipulate administrative resources across tenant boundaries, exposing confidential business data and enabling unauthorized changes to other customers' Accounts Receivable (AR) automation configurations.

Affected Products

Sage Cash Collect
Sage AR Automation API
Deployments prior to the Sage June R2 Release 2026

Discovery Timeline

2026-09-09 - CVE-2026-67403 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-67403

Vulnerability Analysis

The Sage AR Automation API exposes administrative endpoints that segment resources by tenant identifier. The API authenticates the caller but does not verify that the authenticated principal is authorized to act on the tenant referenced in the request. This is a classic Insecure Direct Object Reference (IDOR) pattern tracked as [CWE-639]: Authorization Bypass Through User-Controlled Key.

Because the tenant identifier is not predictable, an attacker cannot trivially guess valid values. However, tenant identifiers frequently leak through support communications, referral URLs, invoices, integration payloads, or browser history. Once an attacker obtains a valid identifier, the missing server-side authorization check allows cross-tenant access using an otherwise legitimate account.

Root Cause

The root cause is missing tenant-scope enforcement in the authorization layer of the AR Automation API. The API relies on the authenticated identity for coarse-grained access but fails to bind requests to the tenant context associated with that identity. Administrative resources are therefore reachable whenever the caller supplies a syntactically valid tenant identifier.

Attack Vector

Exploitation requires an authenticated Sage Cash Collect account and knowledge of a target tenant identifier. The attacker sends an API request that references the victim tenant's identifier in place of their own. The server returns or mutates administrative resources belonging to the referenced tenant. No user interaction is required on the victim side, and the attack traverses the network.

Refer to the Sage Help Center - June R2 Release 2026 advisory for vendor technical details.

Detection Methods for CVE-2026-67403

Indicators of Compromise

API requests where the authenticated user's tenant context does not match the tenant identifier supplied in the request path, headers, or body.
Sudden access to administrative endpoints from accounts that have never previously invoked them.
Bursts of requests iterating across different tenant identifiers from a single authenticated session or Internet Protocol (IP) address.

Detection Strategies

Correlate API access logs against a mapping of user-to-tenant assignments and alert on any mismatch between the caller's tenant and the requested tenant resource.
Baseline normal administrative endpoint usage per account and flag deviations, particularly access to endpoints outside the account's role scope.
Review authentication and API gateway telemetry for repeated 200-response codes on tenant-scoped administrative routes from non-administrative principals.

Monitoring Recommendations

Ingest Sage AR Automation API access logs into a Security Information and Event Management (SIEM) platform for cross-tenant anomaly detection.
Monitor for exfiltration patterns such as bulk downloads of AR configurations, customer lists, or collection rules following anomalous API calls.
Track administrative changes made through the API and reconcile them against approved change tickets for each tenant.

How to Mitigate CVE-2026-67403

Immediate Actions Required

Confirm your Sage Cash Collect environment has been updated to the June R2 Release 2026 or later, which contains the vendor fix.
Rotate credentials and API tokens for administrative accounts that had access to the AR Automation API prior to remediation.
Audit administrative resources across tenants for unauthorized changes made before the patch was applied.
Restrict administrative API access to known IP ranges and enforce multi-factor authentication (MFA) on all Cash Collect accounts.

Patch Information

Sage addressed the vulnerability in the Cash Collect June R2 Release 2026. Because Cash Collect is delivered as a SaaS product, most customers receive the fix automatically. Review the Sage Help Center - June R2 Release 2026 notes to confirm the patched build is active in your tenant.

Workarounds

No configuration-level workaround fully eliminates the flaw; apply the vendor patch as the primary control.
Limit administrative role assignments to the minimum set of users required for AR operations to reduce the population of accounts that could abuse the flaw.
Continuously review API audit logs for cross-tenant access attempts until the patched release is confirmed in production.

bash

# Verify patched release is active in your Sage Cash Collect tenant
# (example curl against the tenant status endpoint - adjust host as needed)
curl -H "Authorization: Bearer <token>" \
     https://<your-tenant>.sage.com/api/status \
     | jq '.release'
# Expected: "June R2 2026" or later