{"id":"CVE-2026-111490","aliases":[],"cve":{"records":[{"id":"CVE-2026-111490","source":"INCIBE","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-16T09:54:29.941Z","published":"2026-11-05T21:49:40.608Z","modified":"2026-11-05T21:49:40.608Z"}],"publishers":[{"name":"INCIBE","role":"CNA","organizationId":"0cbda920-cd7f-484a-8e76-bf7f4b7f4516","modified":"2026-11-05T21:49:40.608Z"}],"references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint","tags":[],"source":"INCIBE"}],"weaknesses":[{"id":"CWE-639","description":"CWE-639 Authorization bypass through User-Controlled key","source":"INCIBE"}],"applicability":[{"source":"INCIBE","statements":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*"}]}]}]}],"prioritization":[]},"title":"Insecure direct object reference (IDOR) vulnerability in the MatchPoint API","titleSource":"INCIBE","descriptionSource":"INCIBE","description":"Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances.","score":9.9,"severity":"critical","published":"2026-11-05T21:49:40.608Z","modified":"2026-11-05T21:49:40.608Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"TPC Software","name":"Matchpoint","platforms":[],"versions":[{"version":"Versions prior to latest one","status":"affected"}],"defaultStatus":"unaffected","cpes":[],"source":"INCIBE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111490"}],"remediation":[{"text":"The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.","source":"INCIBE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111490"}],"references":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"],"sources":[{"name":"CVE","id":"CVE-2026-111490","modified":"2026-11-05T21:49:40.608Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-111490"}],"assessments":[{"source":"INCIBE","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","score":9.9}],"sourceAffected":[],"observedAt":"2026-11-05T22:35:45.673Z","kev":{"status":"not-listed","checkedAt":"2026-11-07T23:00:33.112Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-05T22:45:35.978Z","attemptedAt":"2026-11-05T22:45:35.978Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-05T22:45:36.323Z","attemptedAt":"2026-11-05T22:45:36.323Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-05T22:45:36.257Z","attemptedAt":"2026-11-05T22:45:36.257Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-05T22:45:35.651Z","attemptedAt":"2026-11-05T22:45:35.651Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-111490","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111490","modified":"2026-11-05T22:36:02.320","score":9.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-05T22:45:35.978Z"}],"aiSummary":{"text":"The MatchPoint API has an insecure direct object reference vulnerability, allowing unauthorized access to user data. Affected versions are those prior to the latest one. The weakness is due to the API relying on the `actingasuser` HTTP header without proper authorization verification.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-05T22:36:12.274Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-111490"}]}}