Live › vulnerability › CVE-2026-121582
Umami, a web analytics tool, has an authorization bypass in its Record API endpoint (src/app/api/record/route.ts) when the Website argument is manipulated. A remote attacker may be able to submit or act on website data they should not have access to.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Teams that self-host Umami 3.4.1 or earlier and expose its record API endpoint to the internet. The sources do not say which configurations are affected, and the vendor did not respond to the disclosure, so no patch is confirmed.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-121582")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.