Umami CVE-2026-121582

Exploitation targets Umami's Record API endpoint (src/app/api/record/route.ts), which is a public, by-design event-collection endpoint, so no authentication is required (PR:N confirmed by the CVSS vector). The specific prerequisite is the ability to supply the Website argument/identifier for a site the attacker does not control; the endpoint fails to authorize that the caller owns the referenced website, allowing unauthorized writes of analytics records. Affected scope is Umami up to and including 3.4.1. Limiting factors: the attacker needs a valid or guessable website ID; impact is confined to the integrity and availability of analytics data (record injection/pollution) with no confidentiality disclosure (VC:N), and there is no indication of code execution or access to admin data. No special non-default configuration is described - the endpoint is enabled in normal operation of the analytics service.

This is a medium-severity authorization issue, not a drop-everything emergency, and the signals are internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which fits the Record API endpoint - Umami's event-collection endpoint is intentionally public, so the 'bypass' is that the Website argument is not properly authorized rather than that an auth wall is defeated. Impact is deliberately narrow: VC:N (no data disclosure), VI:L and VA:L (limited integrity/availability effect), meaning the realistic outcome is injection/pollution of analytics records against website IDs the attacker does not own, not code execution or data theft. Exploit maturity is E:P (Proof-of-Concept), and a public PoC reference is linked, but the CVE is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active, widespread exploitation. The vuln.today decision label is 'this_month', consistent with a genuine but non-critical issue. Net: a real, confirmed-mechanism authorization weakness worth patching on a normal cycle, whose low impact ceiling keeps it below high-priority appliances/RCE-class work. Note the vendor did not respond to disclosure, so an authoritative fixed version is not confirmed in the available data.

An unauthenticated remote attacker sends crafted requests to Umami's public Record API endpoint (src/app/api/record/route.ts) while manipulating the Website argument to reference a website ID they do not own, bypassing the authorization check and writing falsified analytics events into another tenant's/site's data. A public PoC reference exists (it is not verified as working exploit code), and because the endpoint is network-facing and requires no authentication, the attack needs only a valid or guessable website identifier.