What is GHSA-vmf4-h3q5-wwrw?

GHSA-vmf4-h3q5-wwrw is a security advisory published by GitHub Security Advisories with Critical severity. Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the ...

Which CVE IDs does GHSA-vmf4-h3q5-wwrw cover?

GHSA-vmf4-h3q5-wwrw covers the following CVE IDs: CVE-2026-111490. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-vmf4-h3q5-wwrwCritical

Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the ...

Vendor

GitHub Security Advisories

Published

November 6, 2026

Last Modified

November 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-111490 →

📋 Description

Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the actingasuser HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-111490
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint
https://github.com/advisories/GHSA-vmf4-h3q5-wwrw