Overview Two vulnerabilities in the REST API were found in Golf Compete foreUP. The first exposes the merchant, Finix, API credentials directly in customer record responses, allowing any user to obtain and use the payment processor account. The second is a missing object-level authorization check, which lets a user retrieve any other customer's full profile, payment token, and transaction history by changing the golfer_id in the request path. Description Golf Compete foreUP provides cloud-based golf course management software to over 2,000 golf courses. They offer tools that allow the management of customers, inventory, tee times, food & beverages, marketing, billing, etc. The vulnerabilities identified are listed below. CVE-2026-15657 A vulnerability in the foreUP customer REST API exposes merchant credentials. Each customer record response includes the facility’s merchant API credentials in cleartext, exposing the following details: finix_username finix_password finix_merchant_id Merchant credentials are identical across for customers at the same facility and are actively used by the backend to register new payment instruments. Any authenticated customer can obtain the facility’s merchant credentials when querying own record. Combined with the second vulnerability described below, an attacker can retrieve merchant credentials from any customer record at the facility. CVE-2026-15658 A missing object-level authorization also known as BOLA (Broken Object Level Authorization) and IDOR (Insecure Direct Object References) in the REST API endpoint returns the record identified by golfer_id without verifying ownership. A caller can substitute any golfer_id while using their own valid JSON Web Token (JWT) and receive another customer's full profile, including the following details: Name, email, phone numbers, date of birth, address Free‑text household relationship notes Finix payment‑instrument tokens Dwolla bank funding‑source tokens Billing and transaction history Impact With a single valid low‑privilege foreUP customer account, someone can perform the following actions: 1. Retrieve any customer’s full profile and contact data 2. Access stored card tokens and Dwolla ACH funding-source tokens 3. Enumerate and view full billing and transaction history for any customer 4. Obtain live Finix merchant API credentials for the facility Also, because the web API is shared by all tenants, all facilities using foreUP are affected, meaning that a customer from facility A could query merchant information from facility B. Solution On 07/26/2026, foreUP confirmed that all vulnerabilities in this report have been remediated. Users should remain aware of increased phishing and identity theft risks and monitor their accounts for suspicious activity. Acknowledgements Thank you to Eric Mead for reporting this vulnerability. This document was written by Bob Kemerer. Vendor Information One or more vendors are listed for this advisory. Please reference the full report for more information. References https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/ https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/12-API_Testing/02-API_Broken_Object_Level_Authorization https://portswigger.net/web-security/access-control/idor https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References Other Information CVE IDs: CVE-2026-15657 CVE-2026-15658 Date Public: 2026-07-30 Date First Published: 2026-07-30 Date Last Updated: 2026-07-30 15:12 UTC Document Revision: 1 About vulnerability notes Contact us about this vulnerability Provide a vendor statement

AI Analysis