CERT/CC disclosed two vulnerabilities in foreUP's REST API: cleartext merchant credentials in customer records (CVE-2026-15657) and a broken object-level authorization allowing access to any user's data (CVE-2026-15658) > affecting over 2,000 golf courses, the bugs were patched July 26, 2026 > CVE-2026-15658 lets a caller substitute any golfer_id into the API path while presenting a valid JWT > the vulnerabilities were reported by Eric Mead, and foreUP confirmed remediation on July 26, 2026 > CERT/CC published VU#790363 detailing two REST API vulnerabilities in the Golf Compete foreUP platform, used by over 2,000 courses for cloud-based management of > the first, CVE-2026-15657, dumps Finix merchant credentials in cleartext inside every customer record response > the second, CVE-2026-15658, is a textbook BOLA/IDOR: the endpoint that returns a golfer's full profile never checks whether the requestor owns that golferid https://news.ojobit.com/story/foreup-api-vulnerabilities-payment-credentials-customer-data-041e20
Post summary
CERT/CC announced two REST API flaws in foreUP: one discloses cleartext merchant credentials, and the other allows unguarded BOLA/IDOR access. The issues were patched on July 26, 2026 and the platform confirmed remediation.