Description
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.
Published: 2026-11-05
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Sensitive Data Exposure
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows an unauthenticated attacker to request profile photos from the Images.ashx endpoint using predictable identifiers, resulting in disclosure of personal user images. This flaw is a missing authentication weakness (CWE-306) that enables data exfiltration without the need for user credentials.

Affected Systems

The issue affects TPC Software’s MatchPoint product. All versions prior to the latest released server fix are vulnerable. The vulnerability description specifically references the Images.ashx endpoint in MatchPoint.

Risk and Exploitability

The CVSS score of 8.7 classifies the flaw as high severity, with a high potential for impact should an attacker enumerate the identifiers. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Because the indicated exploit path requires only a standard HTTP request, the attack would be straightforward for an external adversary with network access to the vulnerable server.

Generated by OpenCVE AI on November 5, 2026 at 23:22 UTC.

Remediation

Vendor Solution

The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.

OpenCVE Recommended Actions

  • Deploy the server fixes for CVE-2026-111490 and CVE-2026-111493 that have already been released by the vendor; these fixes are applied automatically regardless of the application version.
  • Upgrade the MatchPoint application to the latest available version to eliminate any remaining related issues.
  • Restrict outbound access to the Images.ashx endpoint or enforce authentication on that endpoint to prevent unauthorized enumeration of image identifiers.

Generated by OpenCVE AI on November 5, 2026 at 23:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 22:15:00 +0000

Type Values Removed Values Added
Description Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.
Title Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint
First Time appeared Tpc Software
Tpc Software matchpoint
Weaknesses CWE-306
CPEs cpe:2.3:a:tpc_software:matchpoint:versions_prior_to_latest_one:*:*:*:*:*:*:*
Vendors & Products Tpc Software
Tpc Software matchpoint
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Tpc Software Matchpoint
cve-icon MITRE

Status: PUBLISHED

Assigner: INCIBE

Published:

Updated: 2026-11-05T21:56:17.098Z

Reserved: 2026-10-16T09:54:32.424Z

Link: CVE-2026-111493

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-05T22:17:44.040

Modified: 2026-11-05T22:36:02.320

Link: CVE-2026-111493

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T23:30:16Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function