CVE-2026-121817: About Time Technologies｜Herowatch Go Server - Insecure Direct Object Reference
Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify specific parameters to access or operate other users' data and functions.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to the Herowatch Go Server and able to reach it remotely. No additional privileges or user interaction are indicated.
What could an attacker do after exploiting it?
By modifying specific parameters, an authenticated attacker may access or operate other users' data and functions. The provided information indicates high confidentiality impact, but does not specify affected data types or functions.
Is a default deployment affected?
The available information does not state whether the vulnerability depends on a non-default configuration. It applies to Herowatch Go Server deployments where authenticated remote users can submit the affected parameters.