CVE-2026-121817

{
  "etk_id": "ETK-2026-3463",
  "cve_id": "CVE-2026-121817",
  "display_id": "CVE-2026-121817",
  "ghsa_id": "GHSA-33f3-4jq2-r259",
  "euvd_id": "EUVD-2026-116749",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Insecure direct object reference in Herowatch Go Server",
  "summary": "Herowatch Go Server has an insecure direct object reference vulnerability. An authenticated attacker may manipulate request parameters to access or act on data and functions associated with other users. Valid account access is required.",
  "mitigation": "Upgrade Herowatch Go Server to the fixed release, *. Verify that object-level authorization is enforced for user-accessible requests.",
  "vendor": "About Time Technologies",
  "product": "Herowatch Go Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < *"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "*"
      ],
      "package_name": "Herowatch Go Server",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.316536183333334,
  "t0_at": "2026-11-04T06:25:37.378000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-04T06:25:37.378000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T06:25:37.378000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-121817"
    }
  }
}