Multiple Vulnerabilities in TPC Software's MatchPoint
Posted date 05/11/2026
Identificador
INCIBE-2026-841
Importance
5 - Critical
Affected Resources
MatchPoint platform.
Description
INCIBE has coordinated the disclosure of 7 vulnerabilities: 3 critical, 2 high, and 2 medium in MatchPoint by TPC Software, a sports facility management platform. The findings were reported by Sergi García Tárraga.
These vulnerabilities have been assigned the following codes, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type:
- CVE-2026-111489: CVSS v4.0: 9.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N | CWE-798
- CVE-2026-111490: CVSS v4.0: 9.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N | CWE-639
- CVE-2026-111491: CVSS v4.0: 6.9 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | CWE-256
- CVE-2026-111492: CVSS v4.0: 8.6 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-89
- CVE-2026-111493: CVSS v4.0: 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | CWE-306
- CVE-2026-111494: CVSS v4.0: 9.1 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | CWE-295
- CVE-2026-111495: CVSS v4.0: 5.1 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | CWE-200
Solution
The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.
Detail
- CVE-2026-111489: A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.
- CVE-2026-111490: Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances.
- CVE-2026-111491: Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform.
- CVE-2026-111492: SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.
- CVE-2026-111493: Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.
- CVE-2026-111494: Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.
- CVE-2026-111495: The report identifies API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element.
CVE
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-111489 | Crítica | No | TPC Software |
| CVE-2026-111490 | Crítica | No | TPC Software |
| CVE-2026-111491 | Media | No | TPC Software |
| CVE-2026-111492 | Alta | No | TPC Software |
| CVE-2026-111493 | Alta | No | TPC Software |
| CVE-2026-111494 | Crítica | No | TPC Software |
| CVE-2026-111495 | Media | No | TPC Software |
References list
Etiquetas
