CVE-2026-68484CWE-862broken-access-control

CVE-2026-68484

published September 9, 2026

CVSS
9.0
EPSS
0%
Percentile
18.3
In the wild
Unconfirmed
What it is

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privileges.

The record
Technical detail
CVSS
9.0 · NONE
CVSS v4.0
9.0 · CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00271 · 18.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-09T20:17Z
References (1)
https://helpcenter.sara.sage.com/hc/en-us/articles/52106283946651-June-R2-Release-2026 · [email protected]
EPSS history
Timeline
  • 11 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 09 SEP 15:49Z
    Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API
    cvelistv5