CVE-2026-111490
Last modified
CVE-2026-111490 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances..
Description
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| TPC Software | Matchpoint | Versions prior to latest one |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-111490?
How severe is CVE-2026-111490?
How do I fix CVE-2026-111490?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-111479Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-11148Inappropriate implementation in Payments in Google Chrome on…6.5
- CVE-2026-111486Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-111487An out-of-bounds write vulnerability in the Qt Framework ass…4.3
- CVE-2026-111489A static credential embedded in the mobile app has been repo…9.9
- CVE-2026-11149Insufficient validation of untrusted input in Extensions in …7.5
- CVE-2026-111491Credentials are stored in plain text in an SQLite database a…6.9
- CVE-2026-111492SQL injection in the push notification handler of the MatchP…8.6
- CVE-2026-111493Lack of authentication and authorization in the Images.ashx …8.7
- CVE-2026-111494Incorrect validation of TLS certificates in the MatchPoint A…9.1
- CVE-2026-111495API keys, credentials, and configuration parameters embedded…5.1
- CVE-2026-111496Kafka Streams derives its stream-time clock from record time…9.1
Are you affected by CVE-2026-111490?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST