---
id: "CVE-2026-111493"
page: "https://infrastack.ai/live/CVE-2026-111493"
kind: "vulnerability"
aliases: ["CVE-2026-111493"]
title: "MatchPoint (TPC Software): unauthenticated Images.ashx endpoint leaks profile photos; vendor says server fix deployed"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "MatchPoint", "fixed": [], "affected": "MatchPoint platform Images.ashx endpoint, versions not stated", "ecosystem": "vendor"}]
ecosystems: []
tags: ["idor", "matchpoint", "other", "self-hosted", "sports-facility", "tpc-software"]
not_affected_if: ["auth-required"]
published_at: "2026-11-05T22:17:44+00:00"
first_seen_at: "2026-11-05T22:46:06+00:00"
updated_at: "2026-11-05T22:49:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111493", "first_seen_at": "2026-11-05T22:46:06+00:00"}, {"source": "analyst", "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint", "first_seen_at": "2026-11-05T22:49:13+00:00", "cites": ["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"]}]
exploit_sources: []
---

# MatchPoint (TPC Software): unauthenticated Images.ashx endpoint leaks profile photos; vendor says server fix deployed

Link for people: https://infrastack.ai/live/CVE-2026-111493 (this .md is for agents)

The Images.ashx endpoint in MatchPoint (TPC Software, sports facility management) has no authentication or authorization checks, and profile photos use predictable identifiers, so an unauthenticated remote attacker can enumerate IDs and download users' photos. INCIBE says linking photos to identities may be easier with other flaws in the platform. The manufacturer says the server fix is already deployed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MatchPoint affected MatchPoint platform Images.ashx endpoint, versions not stated fixed no fixed version listed

## How to check

No version check applies: the fix is server-side. If you operate or host a MatchPoint instance, confirm with TPC Software that the fix is applied to your deployment, then request Images.ashx without a session and with a neighbouring photo ID; it should be refused. Review web logs for sequential Images.ashx requests from one client.

## Fix

Server-side fix already deployed by TPC Software and applied regardless of app version (per INCIBE-CERT relaying the manufacturer). No version number published; nothing to install.

## Timeline

- 2026-11-05T22:46:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111493
- 2026-11-05T22:49:13+00:00 analyst https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint — INCIBE-CERT INCIBE-2026-841 (coordinator relaying manufacturer, not vendor page, so nothing verified): CVE-2026-111493 CVSS4 8.7 CWE-306, not exploited, server fix deployed, no version numbers. No PoC found. Sibling of 111489-111495.

## Documents

- [advisory] INCIBE-2026-841: Multiple Vulnerabilities in TPC Software's MatchPoint https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint

## From the sources

Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_