Improper authorization in Sage AR Automation allows administrator-account creation

Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privileges.

• Sage AR Automation, including Cash Collect: versions less than June-R1-2026 are marked as affected.
• The version data uses a custom version type and sets the default status to unaffected outside the stated affected range.
• June-R1-2026 is the non-affected boundary represented by the structured data. The record does not enumerate every parallel or later branch, so the status of an unverified branch should not be inferred from the version name alone.

The flaw is in administrative functions of the Sage AR Automation API, where user privileges are not adequately checked before sensitive actions are performed. At a high level, the attacker-controlled element is an API request that invokes an administrative function from an authenticated low-privileged account. Exploitation requires network access to the API, a valid account, and no interaction from another user; the supplied record characterizes attack complexity as high. If the request is accepted, the user can create an administrator account and obtain higher privileges. The available record does not identify the endpoint, parameters, implementation function, or specific authorization mechanism, so the exact request sequence and per-function scope remain unknown. The CNA version data identifies versions less than June-R1-2026 as affected.

The vulnerability is reachable over the network by an authenticated user with low privileges. It does not require interaction from another user, while the supplied record characterizes attack complexity as high. The available CISA ADP enrichment records exploitation as none and automatable as no at the time of that assessment. The supplied record does not identify a public exploit or a specific exploitation campaign; that does not rule out activity that has not been reported. The key precondition is a valid account with access to the Sage AR Automation API.

The flaw allows an authenticated low-privileged account to create an administrator account, breaking the application's intended privilege boundary. The resulting account could enable unauthorized access, data or configuration changes, and disruption of administrative functions, depending on the permissions granted in the deployment. The supplied assessment characterizes confidentiality, integrity, and availability impact as high, but it does not describe tenant boundaries, data scope, or the specific administrative functions involved. The actual organizational impact therefore depends on the deployment configuration, available audit evidence, and permissions assigned to the created account.

• A low-privileged user may create an unauthorized administrator account, changing the system's privilege structure and expanding access.
• The created account may provide access to sensitive data, configuration changes, or data modification, depending on the functions exposed in the deployment.
• Unauthorized administrative changes could affect receivables-automation workflows, integration settings, or normal operations.
• If the account is not detected and removed, access could persist beyond the original session. The available evidence does not confirm a specific data breach, service outage, or victim.

1. Inventory Sage AR Automation deployments and identify those running a version less than June-R1-2026.
2. Upgrade affected deployments to June-R1-2026, the non-affected boundary represented in the CNA affected data. Confirm the Sage-supported upgrade path before production deployment.
3. For parallel branches or releases not explicitly enumerated in the record, confirm status with Sage rather than assuming that the branch is fixed.
4. Until updating, restrict network access to the API and review account privileges under least-privilege principles where operationally feasible. These are general risk-reduction measures, not a vendor-confirmed workaround.
5. Review and disable unauthorized administrator accounts, then investigate privilege changes and unusual administrative activity during the affected-version period.
6. Sage also documents security and authentication changes in June-R2-2026, but the available advisory does not explicitly map those changes to this vulnerability. Do not treat that release as independent proof of remediation without confirming that it applies to the deployed release branch.

• Inventory Sage AR Automation deployments that use Cash Collect and identify the exact release running in each environment.
• Prioritize any deployment running a version less than June-R1-2026.
• Review available audit records during the affected-version window for unexpected administrator-account creation, privilege changes, or administrative activity performed by low-privileged accounts.
• Examine newly created administrator accounts and validate their owner, creation time, business justification, and subsequent actions.
• No specific endpoint, log-event name, or IOC is provided by the available evidence. Additional monitoring should therefore be treated as a precaution rather than a vendor-confirmed indicator.