VDB
CVE-2026-15658
CVE-2026-15658
PUBLISHED
CVSS 8.1 HIGH
Reported by certcc · Published July 30, 2026
A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record.
Risk Scores
CVSS 3.1
8.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| foreUP | foreUP | API |
| foreUP | foreUP | API, API |
Timeline
- Jul 30, 2026 Coalition ESS Score
- Jul 30, 2026 CVE Published
- Jul 31, 2026 CVE Updated
- Aug 7, 2026 EPSS Score