Executive brief
A security flaw in the foreUP golf management platform allows any registered user to view sensitive merchant credentials for the payment processor. This information could be used by an attacker to gain unauthorized access to the facility's payment processing account, potentially leading to fraudulent transactions or financial theft. Additionally, because the platform is shared, an attacker at one golf course could potentially access the financial credentials of other facilities using the same software.
Technical details
The foreUP customer REST API improperly includes sensitive merchant credentials in the response body when a customer record is queried. Specifically, the 'finix_username', 'finix_password', and 'finix_merchant_id' are returned in cleartext. While an authenticated user can see these credentials in their own record, the vulnerability is exacerbated by a related Broken Object Level Authorization (BOLA) flaw (CVE-2026-15658) that allows users to query records belonging to other customers or facilities. An attacker with a low-privileged account can exploit this to obtain live API credentials for the Finix payment processor, enabling unauthorized administrative actions on the merchant account. The vendor confirmed that a fix was deployed on July 26, 2026.
Affected products
- foreUP foreUP Golf Management Platform All versions prior to 2026-07-26
Timeline
- 2026-05-27: other: Vendor notified
- 2026-07-26: patched: Vendor confirmed remediation of all reported vulnerabilities
- 2026-07-30: disclosed: Public disclosure by CERT/CC