CVE-2026-15658CWE-639

CVE-2026-15658

High · published July 30, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
27.4
In the wild
Unconfirmed
What it is

A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that

returns the records of other users without checking that the caller owns the data associated with that record.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00350 · 27.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-30T20:16Z
References (1)
https://kb.cert.org/vuls/id/790363 · [email protected]
EPSS history
Timeline
  • 30 JUL 15:18Z
    foreUP customer REST API allows unauthenticated endpoint access
    cvelistv5