MATCHPOINT · CVE-2026-111493 · Other
NO FIX YET · SEE WHAT TO DO
The Images.ashx endpoint in MatchPoint (TPC Software, sports facility management) has no authentication or authorization checks, and profile photos use predictable identifiers, so an unauthenticated remote attacker can enumerate IDs and download users' photos. INCIBE says linking photos to identities may be easier with other flaws in the platform. The manufacturer says the server fix is already deployed.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sports facilities and clubs running TPC Software's MatchPoint platform, and the members whose profile photos it holds. The endpoint was reachable over the network with no login. The manufacturer says the server-side fix is already deployed regardless of app version, so customers mainly need to confirm it with TPC Software; others can skip it.
Not affected if auth-required
Who cares idor, matchpoint, self-hosted, sports-facility, tpc-software
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.