---
id: CVE-2026-121582
title: Umami Record API Endpoint route.ts authorization
summary: >-
  A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown
  function of the file src/app/api/record/route.ts of the component Record API
  Endpoint. Such manipulation of the argument Website leads to authorization
  bypass. T…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-639
  - CWE-285
product: Umami
affected:
  - Umami 3.4.0
  - Umami 3.4.1
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T23:00:26.095Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121582'
references:
  - url: 'https://vuldb.com/vuln/430425'
    label: VDB-430425 | Umami Record API Endpoint route.ts authorization
  - url: 'https://vuldb.com/vuln/430425/cti'
    label: 'VDB-430425 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-121582'
    label: CVE-2026-121582 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1019998'
    label: 'Submit #1019998 | umami-software umami 3.4.0 Improper Access Control'
  - url: 'https://github.com/waterhunter2000-svg/vulnerability-reports'
  - url: >-
      https://github.com/umami-software/umami/security/advisories/GHSA-4cww-5p37-v8r2
  - url: >-
      https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/02-umami-record-unauth-write.md
tags:
  - cve.org
epss: 0.00381
epssPercentile: 0.32228
ingestedAt: '2026-11-05T20:33:06.612Z'
---

## Overview

A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `Umami 3.4.0`
- `Umami 3.4.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.