CVE-2026-15658

A vulnerability in the foreUP golf management platform's customer REST API allows authenticated, low-privilege customers to perform a Broken Object Level Authorization (BOLA) attack. By substituting a golfer_id in the request path while using their own valid JSON Web Token (JWT) , an attacker can...