Sage Ar Automation
Monthly
Privilege escalation in Sage AR Automation (the 'Cash Collect' product) before the June-R1-2026 release allows an authenticated low-privileged user to create administrator accounts through the AR Automation API, because administrative functions fail to enforce privilege checks. Any user with a valid low-level login can promote themselves to full administrative control of the application. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-tenant privilege escalation in Sage AR Automation (the 'Cash Collect' service) lets an authenticated tenant user reach administrative resources belonging to other tenants by supplying a valid tenant identifier that the API fails to authorize against the caller. Because the identifier is non-predictable, exploitation requires first obtaining a legitimate foreign tenant ID, which raises attack complexity but still breaks the multi-tenant isolation boundary of this SaaS platform. Reported via HackerOne; no public exploit code or active exploitation has been identified at time of analysis.
Privilege escalation in Sage AR Automation (the 'Cash Collect' product) before the June-R1-2026 release allows an authenticated low-privileged user to create administrator accounts through the AR Automation API, because administrative functions fail to enforce privilege checks. Any user with a valid low-level login can promote themselves to full administrative control of the application. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-tenant privilege escalation in Sage AR Automation (the 'Cash Collect' service) lets an authenticated tenant user reach administrative resources belonging to other tenants by supplying a valid tenant identifier that the API fails to authorize against the caller. Because the identifier is non-predictable, exploitation requires first obtaining a legitimate foreign tenant ID, which raises attack complexity but still breaks the multi-tenant isolation boundary of this SaaS platform. Reported via HackerOne; no public exploit code or active exploitation has been identified at time of analysis.