Foreup
Monthly
Insecure Direct Object Reference (IDOR) in the foreUP customer REST API exposes records belonging to arbitrary users to any authenticated, low-privilege customer account. The endpoint returns user records based on a caller-supplied identifier without verifying that the requesting customer owns or is authorized to access the requested record. No active exploitation has been confirmed (not listed in CISA KEV), and EPSS places real-world exploitation probability at 0.13% - well below the 3rd percentile - though the high CVSS score of 8.1 reflects the potential confidentiality and integrity impact if an adversary with a valid account begins enumerating records.
foreUP's customer REST API exposes cleartext payment-processor merchant credentials - such as API keys or secrets - directly in response bodies to any authenticated user. All foreUP versions are affected per the wildcard CPE (cpe:2.3:a:foreup:foreup:*). An attacker with any valid authenticated session can harvest these credentials and use them to interact directly with the downstream payment processor, creating potential for financial fraud or account takeover at the payment-processing layer. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Insecure Direct Object Reference (IDOR) in the foreUP customer REST API exposes records belonging to arbitrary users to any authenticated, low-privilege customer account. The endpoint returns user records based on a caller-supplied identifier without verifying that the requesting customer owns or is authorized to access the requested record. No active exploitation has been confirmed (not listed in CISA KEV), and EPSS places real-world exploitation probability at 0.13% - well below the 3rd percentile - though the high CVSS score of 8.1 reflects the potential confidentiality and integrity impact if an adversary with a valid account begins enumerating records.
foreUP's customer REST API exposes cleartext payment-processor merchant credentials - such as API keys or secrets - directly in response bodies to any authenticated user. All foreUP versions are affected per the wildcard CPE (cpe:2.3:a:foreup:foreup:*). An attacker with any valid authenticated session can harvest these credentials and use them to interact directly with the downstream payment processor, creating potential for financial fraud or account takeover at the payment-processing layer. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.