Umami
Monthly
Unauthorized analytics record injection affects Umami through 3.4.1 because the Record API endpoint accepts a Website identifier without verifying that the caller controls that site. Remote unauthenticated attackers who know or guess a website ID can write to or pollute another site's analytics data, with limited integrity and availability impact and no confidentiality exposure; this is a medium-severity authorization issue, not a drop-everything emergency. A public disclosure includes exploit details, but working exploit code is not independently verified and active exploitation is not confirmed in the provided KEV data.
Umami 3.3.x, 3.4.0, and 3.4.1 can allow a user who already holds valid first-factor credentials to complete login without the second factor when an administrator has configured an enforced 2FA policy. The result is a bypass of mandatory two-factor authentication in the login handler at src/app/api/auth/login/route.ts, rated 5.3 (moderate) in the supplied assessment. A public PoC reference exists; it is not verified as working exploit code, and the issue is limited to deployments where enforced 2FA is enabled.
Unauthorized analytics record injection affects Umami through 3.4.1 because the Record API endpoint accepts a Website identifier without verifying that the caller controls that site. Remote unauthenticated attackers who know or guess a website ID can write to or pollute another site's analytics data, with limited integrity and availability impact and no confidentiality exposure; this is a medium-severity authorization issue, not a drop-everything emergency. A public disclosure includes exploit details, but working exploit code is not independently verified and active exploitation is not confirmed in the provided KEV data.
Umami 3.3.x, 3.4.0, and 3.4.1 can allow a user who already holds valid first-factor credentials to complete login without the second factor when an administrator has configured an enforced 2FA policy. The result is a bypass of mandatory two-factor authentication in the login handler at src/app/api/auth/login/route.ts, rated 5.3 (moderate) in the supplied assessment. A public PoC reference exists; it is not verified as working exploit code, and the issue is limited to deployments where enforced 2FA is enabled.