CVE-2026-111493
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.
| CWE | CWE-306 |
| Vendor | tpc software |
| Product | matchpoint |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for tpc software matchpoint
Be the first to know when new unknown vulnerabilities affecting tpc software matchpoint are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
TPC Software / Matchpoint
Versions prior to latest one
References
Credits
Sergi García Tárraga