BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-111490Insecure direct object reference (IDOR) vulnerability in the MatchPoint API

Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances.

9.9 CRITICALEPSS 0.37%Not in KEVNVD: Deferred

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
9.9CRITICAL4.0INCIBE (CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Details

CVE ID
CVE-2026-111490
Status
Deferred
Assigner (CNA)
INCIBE
Published
Nov 5, 2026
Last modified
2026-11-05 22:36 UTC
Weaknesses
  • CWE-639 · Authorization bypass through User-Controlled key

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-09 08:15 UTC.