Insecure Direct Object Reference in MatchPoint API by TPC Software

CVE-2026-111490

What is CVE-2026-111490?

The MatchPoint API from TPC Software contains an insecure direct object reference (IDOR) vulnerability that allows unauthorized access to sensitive user information. This flaw occurs due to the reliance on the actingasuser HTTP header for authorization checks, without proper validation of the requester's permissions. As a result, an attacker could manipulate sequential identifiers to gain access to critical personal and financial data, private messages, and even QR codes for physical access. This vulnerability also poses risks such as unauthorized modifications to third-party accounts, changing passwords, user impersonation, and the transfer of virtual balances, highlighting the urgent need for security measures and timely updates.

References