EUVD-2026-75061
GHSA-cv47-249w-w382
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API requiring a low-privileged authenticated session (PR:L) and non-trivial exploitation (AC:H); escalation to admin grants full C/I/A within the same application (S:U).
Primary rating from Vendor (hackerone).
CVSS VectorVendor: hackerone
Lifecycle Timeline
3DescriptionCVE.org
Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privileges.
AnalysisAI
Privilege escalation in Sage AR Automation (the 'Cash Collect' product) before the June-R1-2026 release allows an authenticated low-privileged user to create administrator accounts through the AR Automation API, because administrative functions fail to enforce privilege checks. Any user with a valid low-level login can promote themselves to full administrative control of the application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated low-privileged user account on a Sage AR Automation ('Cash Collect') instance running a version earlier than the June-R1-2026 release, and the attacker must reach the AR Automation API's administrative account-management functions over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 4.0 vector (AV:N/AC:H/PR:L/UI:N with high confidentiality, integrity and availability impact, score 9.0) indicates a network-reachable flaw that requires an existing low-privileged authenticated session (PR:L) and carries some execution complexity (AC:H), but yields full administrative compromise once achieved. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the fixed Sage AR Automation release described in the June-R2 2026 release notes (https://helpcenter.sara.sage.com/hc/en-us/articles/52106283946651-June-R2-Release-2026); as a hosted/SaaS product, tenants should confirm with Sage that their instance has been moved to the patched build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all current users with access to Sage AR Automation and disable non-essential low-privilege accounts; enable comprehensive logging on administrative functions, account creation, and API calls; review recent administrator account additions for unauthorized promotions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files with
On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Serve
A file disclosure vulnerability exists in Sage 1000 v7.0.0. Rated high severity (CVSS 7.2), this vulnerability is remote
A Reflected Cross-Site Scripting (XSS) vulnerability exists in the Sage 1000 v 7.0.0. Rated medium severity (CVSS 6.1),
Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a
Cross-tenant privilege escalation in Sage AR Automation (the 'Cash Collect' service) lets an authenticated tenant user r
Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection. Rated high severity (CVSS 7.2), this vulnerability is remot
Path traversal in Sage Employee Self Service's custom logo functionality exposes arbitrary server-side files to unauthen
Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Rated medium severity (CVSS 5.4), this vulnera
Multiple stored cross-site scripting (XSS) vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to in
Versions of Sage 300 through 2022 implement role-based access controls that are only enforced client-side. Rated medium
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today