CVE-2026-121817

{
  "etk_id": "ETK-2026-3463",
  "cve_id": "CVE-2026-121817",
  "display_id": "CVE-2026-121817",
  "ghsa_id": "GHSA-33f3-4jq2-r259",
  "euvd_id": "EUVD-2026-116749",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Insecure direct object reference in Herowatch Go Server",
  "summary": "Herowatch Go Server contains an insecure direct object reference vulnerability. An authenticated remote attacker may manipulate request parameters to access or operate on other users' data and functions. Exploitation requires an authenticated account.",
  "mitigation": "Upgrade Herowatch Go Server to fixed version *. Until the update is deployed, limit access to trusted authenticated users and review authorization checks for object-level requests.",
  "vendor": "About Time Technologies",
  "product": "Herowatch Go Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < *"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "*"
      ],
      "package_name": "Herowatch Go Server",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 8.7976054,
  "t0_at": "2026-11-04T06:25:37.378000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-04T10:01:17.688057+00:00",
      "days": 0.1497721071412037,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T06:25:37.378000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-04T06:25:37.378000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T06:25:37.378000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-121817"
    }
  }
}