Software Engineering Institute

Overview

Two vulnerabilities in the REST API were found in Golf Compete foreUP. The first exposes the merchant, Finix, API credentials directly in customer record responses, allowing any user to obtain and use the payment processor account. The second is a missing object-level authorization check, which lets a user retrieve any other customer's full profile, payment token, and transaction history by changing the golfer_id in the request path.

Description

Golf Compete foreUP provides cloud-based golf course management software to over 2,000 golf courses. They offer tools that allow the management of customers, inventory, tee times, food & beverages, marketing, billing, etc. The vulnerabilities identified are listed below.

CVE-2026-15657 A vulnerability in the foreUP customer REST API exposes merchant credentials. Each customer record response includes the facility’s merchant API credentials in cleartext, exposing the following details:

• finix_username
• finix_password
• finix_merchant_id

Merchant credentials are identical across for customers at the same facility and are actively used by the backend to register new payment instruments. Any authenticated customer can obtain the facility’s merchant credentials when querying own record. Combined with the second vulnerability described below, an attacker can retrieve merchant credentials from any customer record at the facility.

CVE-2026-15658 A missing object-level authorization also known as BOLA (Broken Object Level Authorization) and IDOR (Insecure Direct Object References) in the REST API endpoint returns the record identified by golfer_id without verifying ownership. A caller can substitute any golfer_id while using their own valid JSON Web Token (JWT) and receive another customer's full profile, including the following details:

• Name, email, phone numbers, date of birth, address
• Free‑text household relationship notes
• Finix payment‑instrument tokens
• Dwolla bank funding‑source tokens
• Billing and transaction history

Impact

With a single valid low‑privilege foreUP customer account, someone can perform the following actions:
1. Retrieve any customer’s full profile and contact data
2. Access stored card tokens and Dwolla ACH funding-source tokens
3. Enumerate and view full billing and transaction history for any customer
4. Obtain live Finix merchant API credentials for the facility

Also, because the web API is shared by all tenants, all facilities using foreUP are affected, meaning that a customer from facility A could query merchant information from facility B.

Solution

On 07/26/2026, foreUP confirmed that all vulnerabilities in this report have been remediated. Users should remain aware of increased phishing and identity theft risks and monitor their accounts for suspicious activity.

Acknowledgements

Thank you to Eric Mead for reporting this vulnerability. This document was written by Bob Kemerer.

Vendor Information

References

• https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/
• https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/12-API_Testing/02-API_Broken_Object_Level_Authorization
• https://portswigger.net/web-security/access-control/idor
• https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References