CVE-2026-111490 Insecure direct object reference (IDOR) vulnerability in the MatchPoint API

CriticalCVSS 9.9

Published: 2026-11-05 23:49
Updated: 2026-11-10 16:04
Exploit status: No public exploit known

Description

Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the actingasuser HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances.

Affected products

Product	Affected versions	Fixed in
TPC Software Matchpoint	= Versions prior to latest one	No fix listed

References

www.incibe.es

CVSS v4.0

9.9 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: None
Subsequent System Confidentiality: High
Subsequent System Integrity: High
Subsequent System Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): Not available
CWE: CWE-639 Authorization bypass through User-Controlled key

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.