About Time Technologies Herowatch Go Server: Insecure Direct Object Reference (CVE-2026-121817)
An Insecure Direct Object Reference (IDOR) vulnerability in About Time Technologies Herowatch Go Server allows authenticated remote attackers to access or modify data belonging to other users.
CVE search metadata
CVE search record: CVE-2026-121817. Severity: high. CVSS: 7.5. KEV: no. Product: Herowatch Go Server. Brief: About Time Technologies Herowatch Go Server: Insecure Direct Object Reference (CVE-2026-121817). Brief link: https://feed.craftedsignal.io/briefs/2026-11-herowatch-idor/
Triage facts
Revision 1- Applicability
- Herowatch Go Server
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 4, 08:39 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
CVE-2026-121817 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the Herowatch Go Server developed by About Time Technologies. The vulnerability allows an authenticated attacker to manipulate specific request parameters to access, modify, or perform actions on data associated with other user accounts. The vulnerability carries a CVSS v3.1 base score of 7.5.
Impact
Successful exploitation allows for unauthorized data access and unauthorized execution of functions on behalf of other users within the application environment.
Recommendation
- Audit access control implementations within the Herowatch Go Server API endpoints.
- Review authentication logs and API request history for anomalous patterns where a single authenticated session accesses objects (IDs, usernames, or database keys) typically associated with multiple unique user accounts.
- Apply patches provided by About Time Technologies for Herowatch Go Server as soon as they become available.
Immediate actions
Review vendor advisories from About Time Technologies for patch availability.
Threat Hunt
Analyze web server logs for high-frequency access to object identifiers that do not belong to the active authenticated session ID.
Data: Web server access logs, Application-level session/request audit logs
Mitigations
Implement strict server-side authorization checks on all resource-accessing API endpoints to ensure the requesting user owns or has permission to access the requested object ID.
CVE-2026-121817