{"id":"CVE-2026-111493","kind":"vulnerability","aliases":["CVE-2026-111493"],"related":[],"title":"MatchPoint (TPC Software): unauthenticated Images.ashx endpoint leaks profile photos; vendor says server fix deployed","description":"Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.","summary":"The Images.ashx endpoint in MatchPoint (TPC Software, sports facility management) has no authentication or authorization checks, and profile photos use predictable identifiers, so an unauthenticated remote attacker can enumerate IDs and download users' photos. INCIBE says linking photos to identities may be easier with other flaws in the platform. The manufacturer says the server fix is already deployed.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MatchPoint","fixed":[],"affected":"MatchPoint platform Images.ashx endpoint, versions not stated","ecosystem":"vendor"}],"ecosystems":[],"tags":["idor","matchpoint","other","self-hosted","sports-facility","tpc-software"],"not_affected_if":["auth-required"],"how_to_check":"No version check applies: the fix is server-side. If you operate or host a MatchPoint instance, confirm with TPC Software that the fix is applied to your deployment, then request Images.ashx without a session and with a neighbouring photo ID; it should be refused. Review web logs for sequential Images.ashx requests from one client.","fix":"Server-side fix already deployed by TPC Software and applied regardless of app version (per INCIBE-CERT relaying the manufacturer). No version number published; nothing to install.","status":"open","published_at":"2026-11-05T22:17:44+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","triaged_at":"2026-11-05T22:46:35+00:00","updated_at":"2026-11-05T22:49:13+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-05T22:46:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"MatchPoint: unauthenticated Images.ashx endpoint leaks profile photos via predictable IDs","impact":"medium","summary":"The Images.ashx endpoint in MatchPoint has no authentication or authorization checks, and profile photos are addressed by predictable identifiers. An unauthenticated remote attacker can enumerate those identifiers and download users' profile photos.","audience":"businesses","category":"other","nicknames":[],"who_cares":["matchpoint","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker downloads users' profile photos at scale via enumeration","analyst_note":"Find affected MatchPoint versions, vendor fix, and whether the endpoint is reachable externally; check the NVD entry for CVSS details and the vendor advisory.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organisations running MatchPoint with the Images.ashx endpoint reachable from the internet or an untrusted network are exposed to unauthenticated photo download. The sources do not give affected versions or configuration details. Teams not running MatchPoint can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000663,"input_tokens":4239,"output_tokens":478,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected MatchPoint versions, vendor fix, and whether the endpoint is reachable externally; check the NVD entry for CVSS details and the vendor advisory.","search":"'-111493':17A,20A '-2026':16A,19A 'allow':104C 'alreadi':90B 'attack':60B,116C 'authent':46B,94C 'author':48B,96C 'check':49B 'collect':122C 'could':117C 'cve':15A,18A 'deploy':14A,91B 'download':65B,109C 'easier':76B 'endpoint':6A,36B,100C 'enumer':62B,118C 'facil':30B,42B 'facilit':132C 'fix':13A,88B 'flaw':79B 'host':27B 'id':63B 'ident':73B,129C 'identifi':55B,112C,120C 'idor':22B 'images.ashx':5A,35B,99C 'incib':68B 'lack':92C 'leak':7A 'link':70B,125C 'manag':43B 'manufactur':84B 'matchpoint':1A,21A,23B,38B,102C 'may':74B,130C 'photo':9A,52B,67B,71B,106C,124C,127C 'platform':82B,138C 'predict':54B,111C 'profil':8A,51B,105C 'remot':59B,115C 'say':11A,69B,85B 'self':26B 'self-host':25B 'server':12A,87B 'softwar':3A,33B,40B 'sport':29B,41B 'sports-facil':28B 'tpc':2A,32B,39B 'tpc-softwar':31B 'unauthent':4A,58B,114C 'use':53B,110C 'user':66B,123C 'vendor':10A 'vulner':135C","nicknames":[],"mitigations":[],"who_affected":"Sports facilities and clubs running TPC Software's MatchPoint platform, and the members whose profile photos it holds. The endpoint was reachable over the network with no login. The manufacturer says the server-side fix is already deployed regardless of app version, so customers mainly need to confirm it with TPC Software; others can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["matchpoint"],"ptokens":["matchpoint"],"labels":["high","idor","matchpoint","other","selfhosted","sportsfacility","tpcsoftware"],"campaign_type":null,"first_public_at":"2026-11-05T22:17:44+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111493","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111493","severity":null,"published_at":"2026-11-05T22:17:44+00:00","modified_at":"2026-11-05T22:36:02+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","fetched_at":"2026-11-05T22:46:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111493:1837","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint","severity":null,"published_at":"2026-11-05T22:49:13+00:00","modified_at":"2026-11-05T22:49:13+00:00","first_seen_at":"2026-11-05T22:49:13+00:00","fetched_at":"2026-11-05T22:49:13+00:00","note":"INCIBE-CERT INCIBE-2026-841 (coordinator relaying manufacturer, not vendor page, so nothing verified): CVE-2026-111493 CVSS4 8.7 CWE-306, not exploited, server fix deployed, no version numbers. No PoC found. Sibling of 111489-111495.","cites":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"]}],"documents":[{"id":81214,"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint","title":"INCIBE-2026-841: Multiple Vulnerabilities in TPC Software's MatchPoint","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}