CERT/CC disclosed two vulnerabilities in foreUP's REST API: cleartext merchant credentials in customer records (CVE-2026-15657) and a broken object-level authorization allowing access to any user's data (CVE-2026-15658) > affecting over 2,000 golf courses, the bugs were patched July 26, 2026 > CVE-2026-15658 lets a caller substitute any golfer_id into the API path while presenting a valid JWT > the vulnerabilities were reported by Eric Mead, and foreUP confirmed remediation on July 26, 2026 > CERT/CC published VU#790363 detailing two REST API vulnerabilities in the Golf Compete foreUP platform, used by over 2,000 courses for cloud-based management of > the first, CVE-2026-15657, dumps Finix merchant credentials in cleartext inside every customer record response > the second, CVE-2026-15658, is a textbook BOLA/IDOR: the endpoint that returns a golfer's full profile never checks whether the requestor owns that golferid https://news.ojobit.com/story/foreup-api-vulnerabilities-payment-credentials-customer-data-041e20
Post summary
CERT/CC announced two REST API vulnerabilities in foreUP’s platform, with CVE‑2026‑15657 exposing cleartext merchant credentials and CVE‑2026‑15658 enabling unauthorized access; both were patched on July 26, 2026.