CVE-2026-111490

The MatchPoint API is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists because the API relies on the actingasuser HTTP header without properly verifying if the requester is authorized to act as the specified user. By manipulating sequential identifiers, an a...

CVE-2026-111489

The MatchPoint platform by TPC Software is affected by a vulnerability where a static credential embedded within the mobile application returns an 'autorizado' token . This flaw allows for unauthenticated access to the platform's API services . No specific patch version or workaround is provided ...