CVE-2026-111490: fallo crítico en TPC Software Matchpoint
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.9epss 0.4%
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
Productos afectados
TPC Software · MatchpointCVEs relacionadas — TPC Software Matchpoint
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-111493HIGHLack of authentication and authorization in the Images.ashx endpoint in MatchPointEPSS 0.5%CVE-2026-111489CRITICALA static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platformEPSS 0.3%CVE-2026-111494CRITICALIncorrect validation of TLS certificates in the MatchPoint Android appEPSS 0.2%CVE-2026-111492HIGHSQL injection in the push notification handler of the MatchPoint Android appEPSS 0.2%CVE-2026-111495MEDIUMAPI keys, credentials, and configuration parameters embedded in the MatchPoint APKEPSS 0.1%CVE-2026-111491MEDIUMCredentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferencesEPSS 0.1%