Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-121582— Umami Record API Endpoint route.ts authorization

Quick assessment

Affected

n/a Umami

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Umami 3.4.1 及更早版本中发现了一个漏洞。受影响的是组件"Record API Endpoint"中文件 src/app/api/record/route.ts 的一个未知功能。对参数 Website 的恶意操纵可导致授权绕过。该攻击可远程发起。利用方法已向公众公开，可能被利用。厂商已在此披露早期被联系，但未作出任何回应。

CVSS 6.5 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1574 · Hijack Execution Flow

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Umami Record API Endpoint route.ts authorization

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	Umami	3.4.0	`cpe:2.3:a:umami:umami::::::::`

II. Public POCs for CVE-2026-121582

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121582

请登录查看更多情报信息。

Other References for CVE-2026-121582 (7)

https://github.com/waterhunter2000-svg/vulnerability-reports related
https://github.com/waterhunter2000-svg/vulnerability-reports/blob/main/02-umami-record-unauth-write.md exploit
https://github.com/umami-software/umami/security/advisories/GHSA-4cww-5p37-v8r2 broken-link
https://vuldb.com/cve/CVE-2026-121582 third-party-advisory
https://vuldb.com/vuln/430425/cti signature permissions-required
https://vuldb.com/vuln/430425 vdb-entry technical-description
https://vuldb.com/submit/1019998 third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121582

Same Patch Batch · n/a · 2026-11-03 · 9 CVEs total

CVE-2026-106991	7.1 HIGH	HustOJ 24.09.10-26.08.19 任意用户操作漏洞
CVE-2026-121531	6.3 MEDIUM	Umami 2FA Policy route.ts single-factor authentication
CVE-2026-121509	5.3 MEDIUM	Headless CMS Plugin REST API post get_required_post_data information disclosure
CVE-2026-121517	5.0 MEDIUM	IrfanView TIFF Wang Annotation heap-based overflow
CVE-2026-121581	4.3 MEDIUM	ArcReel Provider Test-Connection Endpoint test server-side request forgery
CVE-2026-38595		im3x Scriptables v2-dev 任意文件上传命令注入漏洞
CVE-2026-38600		codeskyblue gohttpserver v1.3.0 存在 Zip Slip 漏洞
CVE-2026-38601		codeskyblue v1.3.0 硬编码密钥导致身份伪造漏洞

IV. Related Vulnerabilities

Same product: Umami

CVE-2026-121531
Umami 2FA Policy route.ts single-factor authentication

Same vendor: n/a

Same weakness: CWE-639