{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/790363#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nTwo vulnerabilities in the REST API were found in Golf Compete foreUP. The first exposes the merchant, Finix, API credentials directly in customer record responses, allowing any user to obtain and use the payment processor account. The second is a missing object-level authorization check, which lets a user retrieve any other customer's full profile, payment token, and transaction history by changing the `golfer_id` in the request path. \r\n\r\n### Description\r\nGolf Compete foreUP provides cloud-based golf course management software to over 2,000 golf courses. They offer tools that allow the management of customers, inventory, tee times, food & beverages, marketing, billing, etc. The vulnerabilities identified are listed below.\r\n\r\n**CVE-2026-15657** A vulnerability in the foreUP customer REST API exposes merchant credentials. Each customer record response includes the facility’s merchant API credentials in cleartext, exposing the following details:\r\n\r\n* finix_username\r\n* finix_password\r\n* finix_merchant_id\r\n\r\nMerchant credentials are identical across for customers at the same facility and are actively used by the backend to register new payment instruments. Any authenticated customer can obtain the facility’s merchant credentials when querying own record. Combined with the second vulnerability described below, an attacker can retrieve merchant credentials from any customer record at the facility.\r\n\r\n**CVE-2026-15658** A missing object-level authorization also known as BOLA (Broken Object Level Authorization) and IDOR (Insecure Direct Object References) in the REST API endpoint returns the record identified by `golfer_id` without verifying ownership. A caller can substitute any `golfer_id` while using their own valid JSON Web Token (JWT) and receive another customer's full profile, including the following details:\r\n\r\n* Name, email, phone numbers, date of birth, address\r\n* Free‑text household relationship notes\r\n* Finix payment‑instrument tokens\r\n* Dwolla bank funding‑source tokens\r\n* Billing and transaction history\r\n\r\n### Impact\r\nWith a single valid low‑privilege foreUP customer account, someone can perform the following actions:\r\n1. Retrieve any customer’s full profile and contact data\r\n2. Access stored card tokens and Dwolla ACH funding-source tokens\r\n3. Enumerate and view full billing and transaction history for any customer\r\n4. Obtain live Finix merchant API credentials for the facility\r\n\r\nAlso, because the web API is shared by all tenants, all facilities using foreUP are affected, meaning that a customer from facility A could query merchant information from facility B.\r\n\r\n### Solution\r\nOn 07/26/2026, foreUP confirmed that all vulnerabilities in this report have been remediated. Users should remain aware of increased phishing and identity theft risks and monitor their accounts for suspicious activity.\r\n\r\n### Acknowledgements\r\nThank you to Eric Mead for reporting this vulnerability. This document was written by Bob Kemerer.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/790363"},{"url":"https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/","summary":"https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/"},{"url":"https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/12-API_Testing/02-API_Broken_Object_Level_Authorization","summary":"https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/12-API_Testing/02-API_Broken_Object_Level_Authorization"},{"url":"https://portswigger.net/web-security/access-control/idor","summary":"https://portswigger.net/web-security/access-control/idor"},{"url":"https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References","summary":"https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References"}],"title":"foreUP golf management platform's web API contains multiple vulnerabilities","tracking":{"current_release_date":"2026-07-30T15:12:59+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.43"}},"id":"VU#790363","initial_release_date":"2026-07-30 15:12:59.447608+00:00","revision_history":[{"date":"2026-07-30T15:12:59+00:00","number":"1.20260730151259.1","summary":"Released on 2026-07-30T15:12:59+00:00"}],"status":"final","version":"1.20260730151259.1"}},"vulnerabilities":[{"title":"A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body.","notes":[{"category":"summary","text":"A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body."}],"cve":"CVE-2026-15657","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#790363"}]},{"title":"A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that\r\nreturns the records of other users without checking that the caller owns the data associated with that record.","notes":[{"category":"summary","text":"A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that\r\nreturns the records of other users without checking that the caller owns the data associated with that record."}],"cve":"CVE-2026-15658","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#790363"}]}],"product_tree":{"branches":[]}}