This vulnerability is an SQL injection flaw that occurs when the application fails to sanitize the 'timezone' parameter. An attacker who has already authenticated can substitute malicious SQL into that parameter, allowing execution of arbitrary commands against the database. The consequence is direct compromise of database confidentiality and integrity, potentially enabling data exfiltration or modification. The weakness aligns with CWE‑89 for SQL Injection.

The flaw affects the Umami Software application, specifically version 3.0.2 and any prior releases that share the same code path for the 'timezone' parameter. The vendor has released version 3.0.3 to address the issue. Systems running the affected version and having authenticated access to the web interface are at risk.

The vulnerability is quantified with a CVSS score of 9.3, reflecting a high risk to all affected users. While the EPSS metric is not available, the lack of KEV listing does not diminish the potential severity. The attack requires the attacker to be authenticated, and the exploit is facilitated by the improper handling of user input, which the vendor has confirmed can lead to arbitrary database modification. Administrators should assume the worst-case scenario of data loss or theft until the patch is applied. The likely attack vector involves sending a crafted HTTP request containing a malicious 'timezone' payload to the application endpoint post‑authentication.