umami
v3.5.0Umami is a privacy-first web and product analytics platform. Traffic, campaigns, behavior, conversions, and revenue in one place. No cookies, no surveillance, self-hosted or in the cloud.
- Maintenance
- Active282 commits in 3 months · bus factor 1
- License
- MITPermissive · OSI-approved
- Security
- 3 advisories2 critical, 1 high
- Supported versions
- No scheduleendoflife.date does not track this project
40.2k stars · 8.6k forks · 129 open issues · last release 3 days ago · data checked 58 minutes ago
Security advisories
All advisories on GitHubThe 3 most recent advisories published by the maintainers: 2 critical, 1 high. Check the patched version against the one you run.
- criticalGHSA-vhf9-rcmp-v5fcNov 13, 2026Unauthenticated SQL injection in the Reports API leads to remote code execution
- Affected
- <= 3.4.0
- highGHSA-3xx8-742v-m4mqJun 30, 2026[HIGH] Cache token from tracking endpoint reusable as share token grants full analytics access without authentication
- Affected
- current (≥ 2.3.1, latest)
- Patched in
- none
- criticalGHSA-8www-cffh-4q98Jul 27, 2023[CRITICIAL] Anyone with a share link can RESET all website data
- Affected
- < 2.3.0
- Patched in
- 2.3.1