Umami vulnerabilities
CVEs whose affected-version data names the Umami package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-121582Medium· 6.5Umami Record API Endpoint route.ts authorization
A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. T…
▾ SunlitEPSS 0.38%via CVEORG
CVE-2026-121531Medium· 6.3PoCUmami 2FA Policy route.ts single-factor authentication
A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the component 2FA Policy Handler. The manipulation leads to use of single-factor authentication. It is…
▾ TwilightEPSS 0.35%via CVEORG