Herowatch Go Server - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/herowatch-go-server/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 08:39:57 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAbout Time Technologies Herowatch Go Server: Insecure Direct Object Reference (CVE-2026-121817)https://feed.craftedsignal.io/briefs/2026-11-herowatch-idor/Wed, 04 Nov 2026 08:39:57 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-herowatch-idor/An Insecure Direct Object Reference (IDOR) vulnerability in About Time Technologies Herowatch Go Server allows authenticated remote attackers to access or modify data belonging to other users.CVE-2026-121817 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the Herowatch Go Server developed by About Time Technologies. The vulnerability allows an authenticated attacker to manipulate specific request parameters to access, modify, or perform actions on data associated with other user accounts. The vulnerability carries a CVSS v3.1 base score of 7.5.

Impact

Successful exploitation allows for unauthorized data access and unauthorized execution of functions on behalf of other users within the application environment.

Recommendation

  • Audit access control implementations within the Herowatch Go Server API endpoints.
  • Review authentication logs and API request history for anomalous patterns where a single authenticated session accesses objects (IDs, usernames, or database keys) typically associated with multiple unique user accounts.
  • Apply patches provided by About Time Technologies for Herowatch Go Server as soon as they become available.
]]>highadvisoryidorweb-application-vulnerability