CVE-2026-121582Medium· 6.5▾ SunlitA vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. T…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Umami 3.4.0Umami 3.4.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-121531Medium· 6.3Umami 2FA Policy route.ts single-factor authentication
CVE-2025-12288Medium· 4.3A vulnerability was detected in Bdtask Pharmacy Management System up to 9.4
CVE-2025-12283Medium· 4.3A security flaw has been discovered in code-projects Client Details System 1.0
CVE-2026-120319Medium· 6.3Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization
CVE-2026-122019High· 7.36amTech 6valley Social Login Flow existing-account-check existingAccountCheck authorization
CVE-2026-121583Medium· 6.3Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization