CVE-2026-15657

A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body...

CVE-2026-15658

A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record...

CVE-2026-15657

A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body...

CVE-2026-15657 foreUP customer REST API allows authenticated users to read cleartext payment-processor merchant credentials

A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body...

CVE-2026-15657

A vulnerability in the foreUP (Golf Compete) customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body. Specifically, each customer record response exposes the facility's finix_username , finix_password , and finix_merchant_id . ...

EUVD-2026-51163

A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body...

CVE-2026-15657 foreUP customer REST API allows authenticated users to read cleartext payment-processor merchant credentials

A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body...

CVE-2026-15658 foreUP customer REST API allows unauthenticated endpoint access

A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record...

CVE-2026-15658

A vulnerability in the foreUP golf management platform's customer REST API allows authenticated, low-privilege customers to perform a Broken Object Level Authorization (BOLA) attack. By substituting a golfer_id in the request path while using their own valid JSON Web Token (JWT) , an attacker can...

CVE-2026-15658 foreUP customer REST API allows unauthenticated endpoint access

A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record...

CVE-2026-15658

A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record...

EUVD-2026-51159

A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record...

CVE-2026-15657: Insufficiently Protected Credentials

A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body...

PT-2026-66501

Name of the Vulnerable Software and Affected Versions foreUP affected versions not specified Description An issue in the customer REST API allows an authenticated user with low privileges to access an endpoint that returns records belonging to other users. This occurs because the system fails to...

PT-2026-66500

Name of the Vulnerable Software and Affected Versions foreUP affected versions not specified Description A flaw in the customer REST API allows any authenticated user to retrieve cleartext payment-processor merchant credentials within the response body. Recommendations At the moment, there is no...

foreUP golf management platform's web API contains multiple vulnerabilities

Overview Two vulnerabilities in the REST API were found in Golf Compete foreUP. The first exposes the merchant, Finix, API credentials directly in customer record responses, allowing any user to obtain and use the payment processor account. The second is a missing object-level authorization check...

CVE-2026-15658: Authorization Bypass Through User-Controlled Key

A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record...