Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🆕 New CVEs TPC Software Matchpoint: 2 critical CVEs Worst: static credential in mobile app grants API access (CVE-2026-111489) No patch listed yet https://cve.now/CVE-2026-111489?release=CVE-2026-111490&utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=rollup
CVE-2026-111490 · CRITICAL · CVSS 9.9 The MatchPoint API has an insecure direct object reference vulnerability, allowing unauthorized access to user data. Affected versions are those prior to the latest one. CVSS 4.0 · INCIBE https://cve.new/CVE-2026-111490
CVE-2026-111490: CVSS 9.9 critical advisory is out Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. https://www.cve.org/CVERecord?id=CVE-2026-111490 #CyberSecurity #InfoSec #ThreatIntel #IAM #SAML #OIDC #MFA #ZeroTrust #VulnerabilityManagement #PatchManagement
🆕 New CVE: CVE-2026-111490 (CVSS 9.9, Enclave score 5/10) Insecure direct object reference (IDOR) vulnerability in the MatchPoint API Remote, no login needed. Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on… https://app.enclave.ai/threat-feed/CVE-2026-111490
🔴 TPC Software Matchpoint: Insecure direct object reference (IDOR) vulnerability in the MatchPoint API (CVE-2026-111490) No fix listed yet https://agentprime.io/advisories/CVE-2026-111490/