{"id":"EM-20261105-ZXZ7","url":"https://cyber.eventmonitor.net/incident/EM-20261105-ZXZ7/matchpoint-vulnerability-cve-2026-111493/","type":"cve","title":"MatchPoint Vulnerability (CVE-2026-111493)","subtitle":"CVE-2026-111493","subject":"CVE-2026-111493","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-05T22:17:44.040Z","firstSignal":"2026-11-05T21:56:17.000Z","lastSignal":"2026-11-05T22:17:44.040Z","updated":"2026-11-05T23:41:30.303Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T22:17:44.040Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-05T22:17:44.040Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-05T21:56:17.000Z","what":"First signal: C8 EU Vulnerability Database (EUVD)"},{"at":"2026-11-05T22:17:44.040Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261105-ZXZ7 created."}],"stages":[{"name":"Disclosed","at":"2026-11-05T22:17:44.040Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-05T22:17:44.040Z","detail":"CVSS 8.7"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-05T21:56:17.000Z","source":"C8","sourceName":"EU Vulnerability Database (EUVD)","role":"Database","severity":3,"title":"EUVD-2026-117818 / CVE-2026-111493 (score 8.7)","text":"Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be fa","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117818"},{"at":"2026-11-05T22:17:44.040Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-111493 (CVSS 8.7)","text":"Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111493"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-05T22:17:44.040","score":8.7,"severity":"HIGH","desc":"Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be fa","product":"","seen":1793922090303},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}