{"id":"CVE-2026-15657","aliases":["EUVD-2026-51163","GHSA-mm4c-2vv9-p2gv"],"status":"published","title":"foreUP customer REST API allows authenticated users to read cleartext payment-processor merchant credentials","description":"A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0034,"percentile":0.27863,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-522"],"published":"2026-07-30T15:22:40Z","modified":"2026-10-23T22:10:00Z","products":[{"vendor":"foreup","product":"foreup"}],"references":[{"url":"https://kb.cert.org/vuls/id/790363"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15657"},{"url":"https://github.com/advisories/GHSA-mm4c-2vv9-p2gv"}],"sources":{"cve":[{"id":"CVE-2026-15657","title":"foreUP customer REST API allows authenticated users to read cleartext payment-processor merchant credentials","description":"A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body.","status":"published","published":"2026-07-30T15:22:40.443Z","modified":"2026-07-31T19:31:10.005Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T13:47:51.033687Z"}],"euvd":[{"id":"EUVD-2026-51163","description":"A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body.","status":"published","published":"2026-07-30T15:22:40Z","modified":"2026-07-31T19:31:10Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:25.159179Z"}],"ghsa":[{"id":"GHSA-mm4c-2vv9-p2gv","title":"A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext...","description":"A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body.","status":"published","published":"2026-07-30T18:31:37Z","modified":"2026-07-31T21:31:53Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:10:00.950607Z"}],"nvd":[{"id":"CVE-2026-15657","description":"A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body.","status":"published","published":"2026-07-30T16:16:56.6Z","modified":"2026-10-23T22:10:00.16Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:12:33.955581Z"}]}}