Threats tagged 'ghsa-vmf4-h3q5-wwrw'

An Insecure Direct Object Reference (IDOR) vulnerability exists in the MatchPoint API due to reliance on the actingasuser HTTP header without verifying the requester's authorization. This flaw allows attackers to manipulate sequential identifiers to access and modify sensitive personal, banking, and financial data, private messages, QR codes for physical access, and third-party accounts, including changing passwords and transferring virtual balances.