Umami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109

Vulnerability

CVE-2025-10931 describes a cross-site scripting (XSS) vulnerability in the Drupal Umami Analytics module [1]. The root cause is that the permission 'administer umami analytics' lacks the 'restrict access' flag, which should alert administrators that this permission is potentially dangerous [2]. This permission allows an administrator to insert an arbitrary JavaScript file on every page of the site [2].

Exploitation

The vulnerability is mitigated by the fact that an attacker must have a role with the 'administer umami analytics' permission to exploit it [2]. Therefore, the attack surface is limited to privileged users such as site administrators or users assigned roles with that permission. The attacker could inject malicious JavaScript code that would execute in the context of any user visiting the site.

Impact

Successful exploitation could lead to cross-site scripting (XSS), allowing an attacker to perform actions such as stealing session cookies, defacing the site, or redirecting users to malicious sites [1][2]. The CVSS vector and severity have not yet been provided by NVD [1].

Mitigation

The Drupal Security Team has released a fix in Umami Analytics 1.0.1 (and 2.0.-beta3) [2]. Users are advised to upgrade to the latest version and review which roles and users have the 'administer umami analytics' permission, permission to ensure only trusted users are granted that permission [2].