Multiple Vulnerabilities in MatchPoint by TPC Software
INCIBE has coordinated the communication of seven vulnerabilities detected in MatchPoint, the sports center management platform developed by TPC Software. These vulnerabilities, affecting various components of the platform, include three critical, two high, and two medium severity issues.
Technical Details of Detected Vulnerabilities
The vulnerabilities in MatchPoint TPC Software are identified under the codes CVE-2026-111489 to CVE-2026-111495, with CVSS v4.0 scores reflecting different levels of severity. Among the most critical are:
- CVE-2026-111489: A static credential embedded in the mobile application was detected, allowing unauthorized access to API services without prior authentication.
- CVE-2026-111490: An insecure direct object reference (IDOR) vulnerability in the API that allows access to personal and financial data, modification of accounts, password changes, and identity impersonation through manipulation of sequential identifiers and the HTTP header actingasuser.
- CVE-2026-111494: Issues in TLS certificate validation in the Android application, with a TrustManager that accepts any certificate and a permissive hostname verifier, as well as allowing unencrypted HTTP traffic, exposing communications to interception and manipulation.
Other relevant vulnerabilities include the storage of credentials in plain text in the local database and Android shared preferences (CVE-2026-111491), SQL injection in the push notification manager (CVE-2026-111492), absence of authentication and authorization mechanisms in an endpoint for downloading profile pictures (CVE-2026-111493), and exposure of API keys and configuration parameters in the application APK (CVE-2026-111495).
Impact and Scope of the Vulnerabilities
The vulnerabilities in MatchPoint TPC Software affect the confidentiality, integrity, and authenticity of the information handled by the platform. For example, the IDOR (CVE-2026-111490) could allow an unauthenticated remote attacker to access and modify sensitive information of other users, while the lack of authentication in the image endpoint (CVE-2026-111493) facilitates mass downloading of profile pictures using predictable identifiers.
In the case of incorrect TLS certificate validation (CVE-2026-111494), an attacker capable of intercepting traffic can read and modify communications, including credentials and personal data. However, the identified SQL injection (CVE-2026-111492) has a local scope, affecting only the compromised device.
Recommended Measures and Solutions
The manufacturer has communicated that server fixes for vulnerabilities CVE-2026-111490 and CVE-2026-111493 are already deployed and apply regardless of the application version. For the remaining vulnerabilities, the recommendation is to install the latest available version of MatchPoint.
These actions aim to mitigate the risks associated with the vulnerabilities in MatchPoint TPC Software, although the manufacturer has not reported any active exploitation of these flaws.
Origin and Coordination of the Notice
The findings were reported by Sergi García Tárraga and coordinated by INCIBE, which published the notice on November 5, 2026. INCIBE has assigned critical importance to the set of vulnerabilities, highlighting the need for immediate attention from users and administrators of the platform.
This coordination is part of INCIBE's functions to alert and facilitate the management of cybersecurity incidents in Spain. The notice can be consulted at the original source.
Limitations of the Notice and Conclusions
The notice does not inform about active exploitation of the vulnerabilities or any resulting incidents. It also does not provide details on the possible impact on specific users or the evolution of the fixes beyond those indicated.
Therefore, it is limited to describing the detected vulnerabilities in MatchPoint TPC Software, their severity, potential impact, and the recommended measures for mitigation, without delving into contextual analysis or specific scenarios.
Published: 09/11/2026.
This article may have been prepared with the assistance of artificial intelligence tools. View AI policy
You can support the project or share this article in one click. At least this block does something useful.