CVE-2026-111493

{
  "etk_id": "ETK-2026-3687",
  "cve_id": "CVE-2026-111493",
  "display_id": "CVE-2026-111493",
  "ghsa_id": "GHSA-7x75-7v3v-8686",
  "euvd_id": "EUVD-2026-117818",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated profile photo access in MatchPoint Images.ashx",
  "summary": "TPC Software MatchPoint's Images.ashx endpoint does not enforce access controls for profile-photo retrieval. A remote unauthenticated attacker may enumerate predictable identifiers to collect profile photos. Exploitation requires network access to the exposed endpoint.",
  "mitigation": "Restrict access to Images.ashx through authentication and authorization controls, or block public access to the endpoint until those controls are in place. No fixed version is supported by the available evidence.",
  "vendor": "TPC Software",
  "product": "Matchpoint",
  "affected": [
    {
      "affected_notes": [
        "Versions prior to latest one"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Matchpoint",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 9.794131166666666,
  "t0_at": "2026-11-05T21:56:17.098000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-05T21:56:17.098000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-05T21:56:17.098000+00:00",
      "url": "https://github.com/advisories/GHSA-7x75-7v3v-8686"
    }
  }
}