A vulnerability has been identified in the Record API Endpoint of Umami, where manipulating the Website argument bypasses authorization checks. This flaw enables an attacker to send write requests without valid authentication, potentially leading to unauthorized data modifications. Based on the description, it is inferred that such writes could undermine the integrity of the tracked data.

The affected product is Umami, up to version 3.4.1, as stated in the CVE report. No information about later versions is provided in the entry, so it should be assumed that higher releases may still be vulnerable until patched.

The CVSS score of 6.9 indicates moderate severity. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no currently confirmed widespread exploitation. The defect can be triggered remotely through the public Record API, making the attack vector accessible over the network. Given the remote nature of the endpoint and the authorization bypass, immediate remediation is recommended to prevent potential non‑authentic writes.