CRITICAL 9.9 NVD

CVE-2026-111490

Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's au

Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances.

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-

Published: 2026-11-05 · Source: NVD · Feed updated: 2026-11-06

This critical severity vulnerability with a CVSS score of 9.9 was published on 2026-11-05 via NVD.

Risk Timeline

CVE Disclosed2026-11-05 · 0 days ago

Remediation Resources

Official Advisory

www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tp

vulnfeed aggregates 16809 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.