CVE-2026-15657

MediumCVSS 6.5

Published: 30/07/2026(UTC)Updated: 31/07/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body.

Risk Assessment

The risk is exposure of sensitive credentials, potentially leading to unauthorized transactions or data theft.

Recommendation

Remove credentials from API responses or encrypt them, and restrict access to this endpoint.

Other vulnerabilities in foreUP

CVE-2026-15658High
A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege user to access an endpoint that returns records of other users without checking ownership.

Original NVD description (English source)

A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body.