What is the CVSS score of CVE-2026-15657?

CVE-2026-15657 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

foreUP API CVE-2026-15657

EUVD-2026-51163 MEDIUM

Insufficiently Protected Credentials (CWE-522)

2026-07-30 certcc

GHSA-mm4c-2vv9-p2gv

Information Disclosure Foreup

6.5

CVSS 3.1 · Vendor: certcc

Severity by source

Vendor (certcc) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible API requiring only a low-privilege authenticated session; no integrity or availability impact - purely a credential disclosure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (certcc).

CVSS VectorVendor: certcc

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 22:31 vuln.today

CVSS changed

Jul 31, 2026 - 20:22 NVD

6.5 (MEDIUM)

CVE Published

Jul 30, 2026 - 15:22 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body.

AnalysisAI

foreUP's customer REST API exposes cleartext payment-processor merchant credentials - such as API keys or secrets - directly in response bodies to any authenticated user. All foreUP versions are affected per the wildcard CPE (cpe:2.3:a:foreup:foreup:*). An attacker with any valid authenticated session can harvest these credentials and use them to interact directly with the downstream payment processor, creating potential for financial fraud or account takeover at the payment-processing layer. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

The root cause is CWE-522 (Insufficiently Protected Credentials): the API serializes sensitive merchant payment-processor credentials into plaintext response bodies rather than omitting them, masking them, or returning only non-sensitive references. foreUP is a cloud-based golf course management platform whose REST API is network-accessible; the CPE string cpe:2.3:a:foreup:foreup:*:*:*:*:*:*:*:* indicates all tracked versions are affected. The vulnerability lies in the customer-facing API layer, not in the underlying payment processor itself, meaning the payment processor credentials are exposed as a secondary system. CERT/CC (VU#790363) is the disclosing body, suggesting coordinated disclosure with the vendor.

RemediationAI

No vendor-released patch version has been identified in the available data at time of analysis; consult the CERT/CC advisory at https://kb.cert.org/vuls/id/790363 for current vendor guidance. As an immediate compensating control, organizations should rotate all payment-processor merchant credentials exposed through the foreUP API, treating them as compromised. Access to the foreUP REST API should be restricted to the minimum set of users who require it - removing general customer-facing access if the credential endpoint is not a required business function. API gateway or WAF rules can be used to block or alert on requests to the specific credential-returning endpoint as a detection measure. Note that restricting API access may affect legitimate foreUP workflows and should be coordinated with business stakeholders.