CISA issues notice on foreUP REST API credential and IDOR flaws

Golf Compete foreUP has two vulnerabilities in its REST API, one that discloses merchant credentials in customer record responses and another that omits object-level authorization. An attacker with a valid foreUP customer account can access other customers’ profiles and payment-related data, including live merchant API credentials for the facility.

CVE-2026-15657 affects the foreUP customer REST API by exposing the facility’s merchant API credentials in cleartext in each customer record response. The response includes finix_username, finix_password, and finix_merchant_id. The merchant credentials are identical across customers at the same facility and are used by the backend to register new payment instruments, and any authenticated customer can obtain the facility’s merchant credentials by querying their own record. CVE-2026-15658 is a missing object-level authorization check, also described as BOLA (Broken Object Level Authorization) and IDOR (Insecure Direct Object References), in a REST API endpoint that returns the record identified by golfer_id without verifying ownership. A caller can substitute any golfer_id while using their own valid JSON Web Token (JWT) and receive another customer’s full profile, including Name, email, phone numbers, date of birth, address; free-text household relationship notes; Finix payment-instrument tokens; Dwolla bank funding-source tokens; and billing and transaction history.

With a single valid low-privilege foreUP customer account, someone can retrieve any customer’s full profile and contact data, access stored card tokens and Dwolla ACH funding-source tokens, enumerate and view full billing and transaction history for any customer, and obtain live Finix merchant API credentials for the facility. Because the web API is shared by all tenants, all facilities using foreUP are affected, so a customer from facility A could query merchant information from facility B.

On 07/26/2026, foreUP confirmed that all vulnerabilities in the report have been remediated. The guidance also states that users should remain aware of increased phishing and identity theft risks and monitor their accounts for suspicious activity.

The advisory guidance provided with the report notes the remediation confirmation and includes the instruction to remain aware of phishing and identity theft risks and to monitor accounts for suspicious activity.

Source: kb.cert.org, by Bob Kemerer.