EUVD-2026-75060
GHSA-xwrh-qw65-q9mr
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated (PR:L) network attacker needs a hard-to-guess valid foreign tenant ID (AC:H); cross-tenant access changes scope (S:C) with high confidentiality/integrity and limited availability impact.
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
3DescriptionCVE.org
Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier.
AnalysisAI
Cross-tenant privilege escalation in Sage AR Automation (the 'Cash Collect' service) lets an authenticated tenant user reach administrative resources belonging to other tenants by supplying a valid tenant identifier that the API fails to authorize against the caller. Because the identifier is non-predictable, exploitation requires first obtaining a legitimate foreign tenant ID, which raises attack complexity but still breaks the multi-tenant isolation boundary of this SaaS platform. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires (1) a valid authenticated account on the Sage AR Automation platform (PR:L) and (2) knowledge of a valid, non-predictable tenant identifier belonging to a different tenant - the API performs no tenant-scoping check on that identifier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, score 9.0) reflects network reachability, low-privilege authenticated access, and high impact including a scope change to other tenants. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Because this is a cloud-hosted service, the fix is delivered by the vendor: ensure the environment is on the June-R2 Release 2026 or later, where the tenant-level authorization check was corrected (Sage release notes: https://helpcenter.sara.sage.com/hc/en-us/articles/52106283946651-June-R2-Release-2026); customers on the affected June-R1-2026 or earlier builds should confirm with Sage that their tenant has been migrated. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, engage Sage support to confirm the scope of affected customers and deployment models, immediately review API access logs for cross-tenant administrative requests, and implement network or API gateway controls to restrict access to sensitive tenant endpoints where possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files with
On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Serve
A file disclosure vulnerability exists in Sage 1000 v7.0.0. Rated high severity (CVSS 7.2), this vulnerability is remote
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Sage 1000 v 7.0.0. Rated medium severity (CVSS 6.1),
Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a
Privilege escalation in Sage AR Automation (the 'Cash Collect' product) before the June-R1-2026 release allows an authen
Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection. Rated high severity (CVSS 7.2), this vulnerability is remot
Path traversal in Sage Employee Self Service's custom logo functionality exposes arbitrary server-side files to unauthen
Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnera
Multiple stored cross-site scripting (XSS) vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to in
Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Rated medium
Share
External POC / Exploit Code
Leaving vuln.today