Users of TPC Software’s MatchPoint should install the latest available Android app after INCIBE published seven vulnerability records on November 5. The remediation statement distinguishes fixes already applied on the server from issues that still require a client update. It does not identify a numbered fixed app release.
According to the manufacturer response recorded by INCIBE, server corrections for CVE-2026-111490 and CVE-2026-111493 have already been deployed and apply regardless of the installed app version. The recommendation for the remaining vulnerabilities is to install the latest version.
Server authorization failures
CVE-2026-111490, rated 9.9 under CVSS 4.0, concerns an API that accepts a user-selection header without checking whether the requester may act for that user. INCIBE describes potential access to personal and financial information, private messages and physical-access QR codes, as well as account changes and transfers of virtual balances.
The separate photo-disclosure flaw, CVE-2026-111493, scores 8.7. Predictable identifiers and missing access checks could allow an unauthenticated attacker to collect users’ profile images.
Another critical finding, CVE-2026-111489, also scores 9.9. Its record reports that a credential embedded in the mobile app can obtain a token granting unauthenticated access to API services. These descriptions concern possible exploitation; they do not establish that customer accounts were compromised.
Android risks need separate attention
The mobile findings cover several different exposure paths:
- CVE-2026-111494, CVSS 9.1, concerns permissive certificate and hostname checks, alongside allowed cleartext traffic. An attacker able to intercept communications could read or alter sensitive information.
- CVE-2026-111491, CVSS 6.9, concerns passwords stored without encryption in local app data. Access to that data or a backup could expose account credentials.
- CVE-2026-111492, CVSS 8.6, is SQL injection in the push-notification handler. The record explicitly limits its scope to the device’s local database.
- CVE-2026-111495, CVSS 5.1, concerns extractable values embedded in the APK. The record cautions that impact depends on each value’s capabilities and restrictions; finding a client-side key alone does not establish unrestricted access.
The practical distinction is that a corrected server does not update software already installed on a phone. MatchPoint users should follow the recorded update recommendation, while organizations coordinating remediation should confirm the current app release with their supplier. The affected-version fields describe earlier releases without giving a numerical boundary, so these records alone cannot support a precise version inventory check.
INCIBE credits Sergi García Tárraga with the findings. The retrieved records do not report exploitation in the wild.
