Executive brief
A security flaw in the foreUP golf management platform allows any registered customer to access the private records of other users. By simply changing a user ID in a web request, an attacker can view sensitive personal information, transaction histories, and payment tokens belonging to any customer across any golf course using the system. This could lead to widespread identity theft, exposure of financial data, and unauthorized access to payment processing credentials.
Technical details
The foreUP customer REST API suffers from a Broken Object Level Authorization (BOLA) / Insecure Direct Object Reference (IDOR) vulnerability. An authenticated attacker with low-level customer privileges can access the profile of any other user by substituting a target 'golfer_id' in the request path while using their own valid JSON Web Token (JWT). The API fails to verify if the requesting user has the authority to access the data associated with the requested ID. Successful exploitation grants access to full names, contact details, birth dates, billing histories, and payment instrument tokens (Finix and Dwolla). Furthermore, because the API is shared across tenants, attackers can access data from any facility on the platform. The vendor reportedly remediated the issue on July 26, 2026.
Affected products
- foreUP foreUP Golf Management Platform All versions prior to 2026-07-26
Timeline
- 2026-05-27: other: Vendor notified
- 2026-07-26: patched: Vendor confirmed remediation
- 2026-07-30: disclosed: Public advisory released