umami vulnerabilities

Products

• umami 2
• umami analytics 1

Latest umami CVEs

Newest publication first

1. CVE-2026-121582 Umami Record API Endpoint route.ts authorization

   Published 2026-11-03

   Medium·CVSS 6.9 EPSS 0.38%

   A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exp...

2. CVE-2026-121531 Umami 2FA Policy route.ts single-factor authentication

   Published 2026-11-03

   Medium·CVSS 5.3 EPSS 0.35%

   A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is possible to initiate the attack remotely....

3. CVE-2025-10931 Umami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109

   Published 2025-10-29

   Low·CVSS 3.8 EPSS 0.20%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS).This issue affects Umami Analytics: from 0.0.0 before 1.0.1.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.