Authentication and Authorization Bypass in MatchPoint by TPC Software
CVE-2026-111493

8.7HIGH

Key Information:

Vendor

Tpc Software

Status
MatcHPoint
Vendor
CVE Published:
5 November 2026

What is CVE-2026-111493?

The Images.ashx endpoint in TPC Software's MatchPoint suffers from an authentication and authorization bypass, allowing attackers to exploit predictable user identifiers. This vulnerability enables unauthorized individuals to enumerate and download user profile photos. By exploiting this flaw, attackers can potentially link the downloaded images to user identities, particularly when combined with other weaknesses in the platform. It is essential for users to apply security updates to mitigate this risk.

Affected Version(s)

Matchpoint Versions prior to latest one

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multip...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sergi García Tárraga
.