EUVD-2026-117812

Insecure direct object reference IDOR vulnerability in the MatchPoint API, which relies on the actingasuser HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private...

CVE-2026-111490

Insecure direct object reference IDOR vulnerability in the MatchPoint API, which relies on the actingasuser HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private...

CVE-2026-111490

The MatchPoint API is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists because the API relies on the actingasuser HTTP header without properly verifying if the requester is authorized to act as the specified user. By manipulating sequential identifiers, an a...