CVE-2026-15658

HighCVSS 8.1

Published: 30/07/2026(UTC)Updated: 31/07/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege user to access an endpoint that returns records of other users without checking ownership.

Risk Assessment

The risk is unauthorized disclosure of other users' data, potentially compromising confidentiality and privacy.

Recommendation

Implement access control to verify that the requester owns the data before returning it.

Other vulnerabilities in foreUP

CVE-2026-15657Medium
A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body.

Original NVD description (English source)

A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record.