Executive brief
Umami Software, a web analytics platform, contains a security flaw that could allow a logged-in user to interfere with the underlying database. By sending specially crafted requests, an attacker can bypass security controls to view, modify, or delete sensitive data. This could lead to a total compromise of the analytics information and potentially disrupt the service.
Technical details
A SQL injection (SQLi) vulnerability exists in Umami Software version 3.0.2 due to improper sanitization of the 'timezone' request parameter. The application uses unsafe methods such as 'prisma.rawQuery', 'prisma.$queryRawUnsafe', or raw ClickHouse queries to interpolate user-supplied input directly into SQL statements. An authenticated attacker can exploit this by injecting malicious SQL payloads into the 'timezone' parameter. Successful exploitation allows for unauthorized data access, modification, and the execution of dangerous database functions. The issue is resolved in version 3.0.3.
Affected products
- Umami Software Umami Software application 3.0.2
Timeline
- 2026-03-31: disclosed
- 2026-03-31: advisory
- 2026-03-31: patched: Fixed in version 3.0.3