HEROWATCH GO SERVER · CVE-2026-121817 · Other
NO FIX YET · SEE WHAT TO DO
Herowatch Go Server from About Time Technologies has an insecure direct object reference flaw. A logged-in user can change request parameters to read or act on other users' data and functions.
first public Nov 4, 2026 · 2 sources
Running Herowatch Go Server? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Anyone using the Herowatch Go app and server from About Time Technologies, where several users have accounts on the same service. A logged-in user can change request parameters to read or act on other users' data. The advisory lists all versions as affected and the product as no longer maintained; the exact endpoints are not published.
Not affected if unknown
Who cares end-of-life, herowatch, herowatch-go-server, idor, self-hosted
No fix: TWCERT/CC says the product is no longer maintained; replace it with a supported device.
Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify specific parameters to access or operate other users' data and functions.
This page as .md · .json · in your agent: get_signal("CVE-2026-121817") · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.