CVE-2026-15657

Deferred Deferred - Pending Action

foreUP REST API Credential Exposure Vulnerability

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: CERT/CC

Description

A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-15657

EUVD

EUVD-2026-51163

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability allows any authenticated user to access cleartext payment-processor merchant credentials through the foreUP customer REST API response body.

Detection Guidance

This vulnerability requires detecting if cleartext payment-processor merchant credentials are exposed in API responses. Monitor API traffic for responses containing sensitive credential fields. Check logs for unauthorized access to the foreUP customer REST API endpoints.

Impact Analysis

Attackers could steal merchant credentials, leading to unauthorized access to payment processing systems, financial fraud, or data breaches.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and payment security, such as PCI DSS, GDPR, and HIPAA, due to exposure of sensitive credentials.

Mitigation Strategies

Immediately restrict API access to authenticated users with least privilege. Review API responses for exposed payment-processor credentials and rotate all exposed credentials. Disable the affected API endpoint if possible until patched.

Hi! I’m here to help you understand CVE-2026-15657. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70