Umami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109

This module enables you to add Umami Analytics web statistics tracking system to your website. The "administer umami analytics" permission allows inserting an arbitrary JavaScript file on every page. While this is an expected feature, the permission lacks the "restrict access" flag, which should...

Anyone with a share link can RESET all website data in Umami

Summary Anyone with a share link permissions to view can reset the website data. Details When a user navigates to a /share/ URL, he receives a share token which is used for authentication. This token is later verified by useAuth. After the token is verified, the user can call most of the GET APIs...

GHSA-8WWW-CFFH-4Q98 Anyone with a share link can RESET all website data in Umami

Summary Anyone with a share link permissions to view can reset the website data. Details When a user navigates to a /share/ URL, he receives a share token which is used for authentication. This token is later verified by useAuth. After the token is verified, the user can call most of the GET APIs...

PT-2023-32999 · Umami · Umami

Name of the Vulnerable Software and Affected Versions: Umami affected versions not specified Description: The issue allows anyone with a share link to reset website data. When a user navigates to a /share/ URL, they receive a share token used for authentication, which is later verified by useAuth...

MAL-2022-301 Malicious code in @grubhubprod/umami-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b96d01e08ee7201aa03313e8e722b063f8b0ca20397fcbeaef3a6fae17bdfe8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @grubhubprod/umami-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b96d01e08ee7201aa03313e8e722b063f8b0ca20397fcbeaef3a6fae17bdfe8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...