The foreUP customer REST API contains a vulnerability that permits any authenticated user to retrieve payment-processor merchant credentials in cleartext within the response body. This issue exposes sensitive credentials to users who should not have access to them, potentially compromising payment processing security. There is no information on affected versions or available patches. The vulnerability does not currently have a CVSS score or known exploits in the wild.

Any authenticated user of the foreUP customer REST API can read sensitive payment-processor merchant credentials in cleartext. This could lead to misuse of payment credentials, unauthorized transactions, or further compromise of the payment infrastructure. The exact scope of impact depends on how these credentials are used and protected downstream.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict API access to trusted users only and monitor for unauthorized access. Avoid sharing credentials in API responses and consider rotating exposed credentials if compromise is suspected.