CVE-2026-111493
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows…
- Risk score
- 57/100
- CVSS
- 8.7 v4.0
- Published
- 5 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other …
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.7 high
- Remotely exploitable without logging in
References
Original description
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.
Last activity 5 Nov 2026. Patch Forecast updates every hour.