Vulnerability · Published Nov 5, 2026 · Assigned by INCIBE
CVE-2026-111490Insecure direct object reference (IDOR) vulnerability in the MatchPoint API
Critical 9.9
In plain English
A critical-severity authorization bypass via user-controlled key in Matchpoint from TPC Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Official description
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| TPC Software | Matchpoint | Versions prior to latest one |
Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N