{"id":"CVE-2026-121582","kind":"vulnerability","aliases":["CVE-2026-121582"],"related":[],"title":"Umami: Record API endpoint lets remote users bypass authorization","description":"A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Umami, a web analytics tool, has an authorization bypass in its Record API endpoint (src/app/api/record/route.ts) when the Website argument is manipulated. A remote attacker may be able to submit or act on website data they should not have access to.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["analytics","runtime","self-hosted","umami"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Umami version; the sources say versions up to 3.4.1 are affected.\n- Look at src/app/api/record/route.ts in your deployment to see whether the Website argument is handled as described.","fix":null,"status":"open","published_at":"2026-11-03T23:17:35+00:00","first_seen_at":"2026-11-03T23:45:14+00:00","triaged_at":"2026-11-03T23:45:39+00:00","updated_at":"2026-11-03T23:45:39+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T23:45:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Umami: Record API endpoint lets remote users bypass authorization","impact":"medium","summary":"Umami, a web analytics tool, has an authorization bypass in its Record API endpoint (src/app/api/record/route.ts) when the Website argument is manipulated. A remote attacker may be able to submit or act on website data they should not have access to.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["umami","self-hosted","analytics"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Remote attacker bypasses authorization on analytics record submissions","analyst_note":"Confirm affected versions, whether authentication is required, and whether any fix exists; the vendor advisory linked in the sources was not read.","how_to_check":"- Check the installed Umami version; the sources say versions up to 3.4.1 are affected.\n- Look at src/app/api/record/route.ts in your deployment to see whether the Website argument is handled as described.","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that self-host Umami 3.4.1 or earlier and expose its record API endpoint to the internet. The sources do not say which configurations are affected, and the vendor did not respond to the disclosure, so no patch is confirmed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000674,"input_tokens":4158,"output_tokens":517,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121582':12A,15A '-2026':11A,14A '3.4.1':70C 'abl':48B 'access':60B 'act':52B 'analyt':16B,25B 'api':3A,34B,84C 'argument':40B,90C 'attack':45B,97C 'author':9A,29B,94C 'bypass':8A,30B,95C 'compon':82C 'contact':117C 'cve':10A,13A 'data':55B 'disclos':106C 'disclosur':121C 'earli':118C 'endpoint':4A,35B,85C 'exploit':103C 'file':78C 'found':65C 'function':75C 'host':20B 'impact':71C 'launch':100C 'lead':92C 'let':5A 'manipul':42B,87C 'may':46B,98C,111C 'public':109C 'record':2A,33B,83C 'remot':6A,44B,101C 'respond':125C 'runtim':17B 'self':19B 'self-host':18B 'src/app/api/record/route.ts':36B,79C 'submit':50B 'tool':26B 'umami':1A,21B,22B,67C 'unknown':74C 'use':113C 'user':7A 'vendor':115C 'vulner':62C 'way':128C 'web':24B 'websit':39B,54B,91C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Umami 3.4.1 or earlier and expose its record API endpoint to the internet. The sources do not say which configurations are affected, and the vendor did not respond to the disclosure, so no patch is confirmed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["analytics","medium","runtime","selfhosted","umami"],"campaign_type":null,"first_public_at":"2026-11-03T23:17:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121582","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121582","severity":null,"published_at":"2026-11-03T23:17:35+00:00","modified_at":"2026-11-03T23:17:35+00:00","first_seen_at":"2026-11-03T23:45:14+00:00","fetched_at":"2026-11-03T23:45:14+00:00","note":null}],"documents":[{"id":61634,"url":"https://github.com/umami-software/umami/security/advisories/GHSA-4cww-5p37-v8r2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}