Threats affecting pkg:github/umami-software/umami

CVE-2026-121582 is an authorization bypass vulnerability in Umami affecting versions 3.4.0 and 3.4.1. The flaw exists in the Record API Endpoint, specifically in the file src/app/api/record/route.ts, where manipulation of the Website argument can bypass authorization controls. The vulnerability can be exploited remotely without authentication. Public exploit details have been disclosed, but the vendor has not responded or provided a fix.