CVE-2026-121582: Umami Record API Endpoint route.ts authorization
A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Event History
Frequently Asked Questions
Which deployments are affected?
Umami versions up to 3.4.1 are identified as affected. The issue is in the Record API Endpoint, specifically src/app/api/record/route.ts.
What does an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction according to the supplied vector. Exploitation involves manipulating the Website argument to bypass authorization.
Is public exploitation information available?
Yes. A proof of concept is indicated, and the exploit has been publicly disclosed, so it may be used by attackers.
What is the potential impact?
The provided severity vector rates the issue as medium with a 5.5 score. It indicates no confidentiality impact, with low integrity and availability impact.