{"id":"CVE-2026-121817","kind":"vulnerability","aliases":["CVE-2026-121817"],"related":[],"title":"Herowatch Go Server: insecure object reference exposes other users' data","description":"Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify specific parameters to access or operate other users' data and functions.","summary":"Herowatch Go Server from About Time Technologies has an insecure direct object reference flaw. A logged-in user can change request parameters to read or act on other users' data and functions.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Herowatch Go Server","fixed":[],"affected":"all versions","ecosystem":"vendor"}],"ecosystems":[],"tags":["end-of-life","herowatch","herowatch-go-server","idor","other","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"Check whether you use the Herowatch Go app/server (About Time Technologies). All versions are listed as affected; the advisory gives no version check or endpoint list.","fix":"No fix: TWCERT/CC says the product is no longer maintained; replace it with a supported device.","status":"open","published_at":"2026-11-04T07:17:12+00:00","first_seen_at":"2026-11-04T07:25:30+00:00","triaged_at":"2026-11-04T07:26:21+00:00","updated_at":"2026-11-04T07:27:31+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-11-04T07:26:21Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Herowatch Go Server: insecure object reference exposes other users' data","impact":"medium","summary":"Herowatch Go Server from About Time Technologies has an insecure direct object reference flaw. A logged-in user can change request parameters to read or act on other users' data and functions.","audience":"businesses","category":"other","nicknames":[],"who_cares":["herowatch-go-server","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated users read or change other users' data","analyst_note":"Check the NVD entry and the vendor advisory for affected versions, fixed release and which endpoints take the modified parameters.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations that run the Herowatch Go Server, where users have accounts on the same server. The sources do not name affected versions or the exact endpoints involved, so unknown beyond the product name.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000609,"input_tokens":4095,"output_tokens":399,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor advisory for affected versions, fixed release and which endpoints take the modified parameters.","search":"'-121817':13A,16A '-2026':12A,15A 'access':90C 'act':60B 'attack':84C 'authent':82C 'chang':54B 'cve':11A,14A 'data':10A,64B,95C 'develop':70C 'direct':44B,78C 'end':21B 'end-of-lif':20B 'expos':7A 'flaw':47B 'function':66B,97C 'go':2A,18A,27B,35B,68C 'herowatch':1A,17A,24B,26B,34B,67C 'herowatch-go-serv':25B 'host':33B 'idor':29B 'insecur':4A,43B,77C 'life':23B 'log':50B 'logged-in':49B 'modifi':86C 'object':5A,45B,79C 'oper':92C 'paramet':56B,88C 'read':58B 'refer':6A,46B,80C 'remot':83C 'request':55B 'self':32B 'self-host':31B 'server':3A,19A,28B,36B,69C 'specif':87C 'technolog':40B,74C 'time':39B,73C 'user':9A,52B,63B,94C 'vulner':81C","nicknames":[],"mitigations":[],"who_affected":"Anyone using the Herowatch Go app and server from About Time Technologies, where several users have accounts on the same service. A logged-in user can change request parameters to read or act on other users' data. The advisory lists all versions as affected and the product as no longer maintained; the exact endpoints are not published.","tier":"B","verified":{"fix":{"at":"2026-11-04T07:27:31Z","by":"analyst","doc":"https://www.twcert.org.tw/en/cp-139-11364-0dce6-2.html","run_id":1643},"who_affected":{"at":"2026-11-04T07:27:31Z","by":"analyst","doc":"https://www.twcert.org.tw/en/cp-139-11364-0dce6-2.html","run_id":1643}},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Stop relying on the Herowatch Go app and watch: the maker no longer maintains it, so replace it with a supported device (per Taiwan's TWCERT/CC).","pkeys":["goserver","herowatchgoserver"],"ptokens":["go","herowatch","server"],"labels":["endoflife","herowatch","herowatchgoserver","high","idor","other","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T07:17:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"twcert@cert.org.tw","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121817","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121817","severity":null,"published_at":"2026-11-04T07:17:12+00:00","modified_at":"2026-11-04T07:17:12+00:00","first_seen_at":"2026-11-04T07:25:30+00:00","fetched_at":"2026-11-04T07:25:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-121817:1643","url":null,"severity":null,"published_at":"2026-11-04T07:27:31+00:00","modified_at":"2026-11-04T07:27:31+00:00","first_seen_at":"2026-11-04T07:27:31+00:00","fetched_at":"2026-11-04T07:27:31+00:00","note":"TWCERT/CC (CNA) advisory read: all versions affected, product no longer maintained, no fix. Endpoints/parameters not published. No exploitation or PoC found."}],"documents":[{"id":65116,"url":"https://www.twcert.org.tw/en/cp-139-11364-0dce6-2.html","title":"TWCERT/CC TVN-202611002: Herowatch Go Server - Insecure Direct Object Reference","kind":"advisory","source":"analyst","publisher":null,"text":"Affected Products: Herowatch Go App all versions. Solution: The product is no longer maintained. Users are advised to replace it with a supported device. Credit: legendyang. Public date 2026-11-04. CVSS 4.0 8.7.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}