---
id: "CVE-2026-121582"
kind: "vulnerability"
aliases: ["CVE-2026-121582"]
title: "Umami: Record API endpoint lets remote users bypass authorization"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["analytics", "runtime", "self-hosted", "umami"]
not_affected_if: ["unknown"]
published_at: "2026-11-03T23:17:35+00:00"
first_seen_at: "2026-11-03T23:45:14+00:00"
updated_at: "2026-11-03T23:45:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121582", "first_seen_at": "2026-11-03T23:45:14+00:00"}]
---

# Umami: Record API endpoint lets remote users bypass authorization

Umami, a web analytics tool, has an authorization bypass in its Record API endpoint (src/app/api/record/route.ts) when the Website argument is manipulated. A remote attacker may be able to submit or act on website data they should not have access to.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Umami version; the sources say versions up to 3.4.1 are affected.
- Look at src/app/api/record/route.ts in your deployment to see whether the Website argument is handled as described.

## Timeline

- 2026-11-03T23:45:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121582

## Documents

- [advisory] Vendor advisory: github.com https://github.com/umami-software/umami/security/advisories/GHSA-4cww-5p37-v8r2

## From the sources

A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_