The foreUP customer REST API contains an access control vulnerability (CVE-2026-15658) where authenticated low-privilege customers can retrieve records belonging to other users. This occurs because the API endpoint fails to check whether the caller owns the data associated with the requested record, resulting in unauthorized data disclosure. No patch or remediation details are available, and the service is not cloud-hosted, implying that remediation depends on the vendor's updates.

Unauthorized access to other users' records can lead to exposure of potentially sensitive customer information. The vulnerability compromises data confidentiality by allowing low-privilege authenticated users to view data they should not have access to. There is no indication of privilege escalation or remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoint where possible and monitor for suspicious activity involving data access. Follow vendor updates closely for official patches or mitigations.