A flaw in foreUP’s customer REST API allows an authenticated low‑privilege customer to call a data‑retrieval endpoint that returns records belonging to other users without verifying ownership. This flaw represents a CWE-639 information‑disclosure vulnerability due to improper authorization. The consequence is that sensitive user information can be exposed across customer boundaries, constituting a confidentiality breach.

The vulnerability exists in any foreUP deployment that does not include ownership validation for the affected API endpoint. No explicit version information is available, so the risk applies to all foreUP releases lacking the fix.

An attacker must possess valid customer credentials, so the vector is authenticated. The CVSS score of 8.1 categorizes this vulnerability as high severity, indicating significant potential impact. The EPSS score is below 1 % and the issue is not listed in CISA’s KEV catalog, suggesting that, so far, there is no known exploit traffic. Despite the low exploitation probability, the vulnerability can lead to cross‑customer data leakage, presenting a high confidentiality risk. Organizations should monitor for updates and apply a fix when it becomes available.