Research scope

MatchPoint is a sports facility management platform. The advisory covers access control, credential storage, notification handling, certificate validation and information exposure.

The published severity ratings are three critical, two high and two medium vulnerabilities. This page summarises the public information and mitigations reported by the vendor. Each finding links to its CVE record.

The report and publication were coordinated with INCIBE-CERT. Thank you to the team for their coordination work.

Published findings

CVSS v4.0

Identifiers, categories and scores from the INCIBE advisory published on 5 November 2026.

  1. CVE-2026-111489Critical 9.9

    Static credential embedded in the app

    A value embedded in the app can be used to obtain a token that grants access to API services without prior authentication.

    CWE-798 Hard-coded credentials

  2. CVE-2026-111490Critical 9.9

    Insufficient access control in the API

    A reference to another user allows access to their data and operations on their account without checking authorisation.

    CWE-639 IDOR

  3. CVE-2026-111491Medium 6.9

    Passwords stored in plaintext

    Credentials are exposed to anyone who can access the app’s local data or a backup.

    CWE-256 Password storage

  4. CVE-2026-111492High 8.6

    SQL injection in notification handling

    Unsafe query construction affects the Android app’s local database. The reported impact is limited to the device.

    CWE-89 SQL injection

  5. CVE-2026-111493High 8.7

    Profile photos without access controls

    Missing authentication and authorisation allow profile photos to be retrieved using predictable identifiers.

    CWE-306 Missing authentication

  6. CVE-2026-111494Critical 9.1

    Incorrect TLS certificate validation

    Permissive validation and support for unencrypted HTTP traffic can expose communications to an attacker able to intercept them.

    CWE-295 Certificate validation

  7. CVE-2026-111495Medium 5.1

    Information and credentials embedded in the APK

    The impact depends on the permissions and restrictions of each exposed element. The vendor distinguishes Google Maps and Firebase project identifiers from authentication secrets.

    CWE-200 Information exposure

Reported mitigations

INCIBE includes the vendor’s response and recommends updating the app to the latest available version.

CVE-2026-111490 / CVE-2026-111493
The vendor reports server-side measures to mitigate unauthorised access, independently of the app version.
Other vulnerabilities
The advisory directs users to update the mobile app.

The advisory does not specify a fixed version number. This section reflects the vendor’s statements to INCIBE; it is not an independent verification of the fixes.

Sources and attribution

Advisory INCIBE-2026-841 credits Sergi García Tárraga with the discovery. All seven CVE records include that credit, and INCIBE’s researcher list records the seven vulnerabilities.

Reviewed on . Refer to the original advisory and CVE records for later updates.