{"metadata": {"vulnerability": "CVE-2026-111490", "count": 17, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 9}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-16T09:54:29.941Z", "date_only": false, "value": "2026-10-16T09:54:29.941Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-111490", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-05T21:48:00Z", "date_only": false, "value": "2026-11-05T21:48:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / INCIBE", "record": "CVE-2026-111490", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T21:49:40.608Z", "date_only": false, "value": "2026-11-05T21:49:40.608Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-111490", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-05T21:49:40.608Z", "date_only": false, "value": "2026-11-05T21:49:40.608Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / INCIBE", "record": "CVE-2026-111490", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-05T21:57:16.796Z", "date_only": false, "value": "2026-11-05T21:57:16.796848Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117566068252439129", "record": "CVE-2026-111490", "field": "creation_timestamp", "uuid": "6bd75f66-0e12-4da3-b10d-01d18c7f6284", "content": "CVE-2026-111490 Insecure direct object reference (IDOR) vulnerability in the MatchPoint API Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances.\nhttps://www.cve.org/CVERecord?id=CVE-2026-111490https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint#TPCSoftware #Matchpoint#CVE_2026_111490#bot", "url": "https://infosec.exchange/users/cve/statuses/117566068252439129"}, {"timestamp": "2026-11-05T22:17:43Z", "date_only": false, "value": "2026-11-05T22:17:43Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-VMF4-H3Q5-WWRW", "record": "GHSA-VMF4-H3Q5-WWRW", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-05T22:17:43.597Z", "date_only": false, "value": "2026-11-05T22:17:43.597", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111490", "record": "FKIE_CVE-2026-111490", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-05T23:10:05.120Z", "date_only": false, "value": "2026-11-05T23:10:05.120005Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzlygcqvgj2p", "record": "CVE-2026-111490", "field": "creation_timestamp", "uuid": "cc8c33f9-5e39-4c3c-85ee-17fb1308aa2a", "content": "CVE-2026-111490 - matchpoint\nThe MatchPoint API trusts a header named \u201cactingasuser\u201d without checking if the caller is allowed to act as that user. Because of this, someone could alter the header to see\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#matchpoint #tpc #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzlygcqvgj2p"}, {"timestamp": "2026-11-06T00:07:59.147Z", "date_only": false, "value": "2026-11-06T00:07:59.147086Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzm3ntrnnm2v", "record": "CVE-2026-111490", "field": "creation_timestamp", "uuid": "361a9953-d8e9-437a-ade1-3f31747d24b7", "content": "\ud83d\udea8 CVE-2026-111490 \u2014 CVSS 9.9 CRITICAL\n\nInsecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasu...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-111490\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzm3ntrnnm2v"}, {"timestamp": "2026-11-06T00:32:44Z", "date_only": false, "value": "2026-11-06T00:32:44Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-VMF4-H3Q5-WWRW", "record": "GHSA-VMF4-H3Q5-WWRW", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-06T00:32:44Z", "date_only": false, "value": "2026-11-06T00:32:44Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-VMF4-H3Q5-WWRW", "record": "GHSA-VMF4-H3Q5-WWRW", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-10T14:04:11.692Z", "date_only": false, "value": "2026-11-10T14:04:11.692009Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111490", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-10T14:04:11.692Z", "date_only": false, "value": "2026-11-10T14:04:11.692009Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111490", "record": "FKIE_CVE-2026-111490", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-10T14:04:56.665Z", "date_only": false, "value": "2026-11-10T14:04:56.665Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-111490", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-10T14:04:56.665Z", "date_only": false, "value": "2026-11-10T14:04:56.665Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-111490", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-10T14:17:11.970Z", "date_only": false, "value": "2026-11-10T14:17:11.970", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-111490", "record": "FKIE_CVE-2026-111490", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-12T18:51:51.113Z", "date_only": false, "value": "2026-11-12T18:51:51.113805Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/7zsj3qenb2nxf", "record": "CVE-2026-111490", "field": "creation_timestamp", "uuid": "eae4c836-fd7e-47e8-b415-13a44398e0fb", "content": "\ud83d\udea8 CVE-2026-111490\nCVSS 9.9 / EPSS 0.38% / KEV: No\nTL;DR: Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's\u2026\nhttps://cvesentinel.com/report/CVE-2026-111490\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/7zsj3qenb2nxf"}], "metrics": {"as_of": "2026-11-13T01:27:46.538Z", "anchors": {"origin": {"timestamp": "2026-11-05T21:48:00Z", "date_only": false, "value": "2026-11-05T21:48:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / INCIBE", "record": "CVE-2026-111490", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-05T21:48:00Z", "date_only": false, "value": "2026-11-05T21:48:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / INCIBE", "record": "CVE-2026-111490", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 617986.538954, "hours": 171.66292748722222, "days": 7.152621978634259, "min_seconds": 617986.538954, "max_seconds": 617986.538954, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-05T21:48:00Z", "date_only": false, "value": "2026-11-05T21:48:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / INCIBE", "record": "CVE-2026-111490", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T01:27:46.538Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}