View online: https://www.drupal.org/sa-contrib-2025-109 Project: Umami Analytics [1] Date: 2025-September-24 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <1.0.1 CVE IDs: CVE-2025-10931 Description:  This module enables you to add Umami Analytics web statistics tracking system to your website. The "administer umami analytics" permission allows inserting an arbitrary JavaScript file on every page. While this is an expected feature, the permission lacks the "restrict access" flag, which should alert administrators that this permission is potentially dangerous and can lead to cross-site scripting (XSS) vulnerabilities. This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer umami analytics”. Solution:  Install the latest version: * If you use the Umami Analytics module upgrade to Umami Analytics 1.0.1 [3] or 2.0.-beta3 [4] Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission. Reported By:  * Pierre Rudloff (prudloff) [5] Fixed By:  * Ivica Puljic (pivica) [6] Coordinated By:  * Damien McKenna (damienmckenna) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Pierre Rudloff (prudloff) [9] provisional member of Drupal Security Team ------------------------------------------------------------------------------ Contribution record [10] [1] https://www.drupal.org/project/umami_analytics [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/umami_analytics/releases/1.0.1 [4] https://www.drupal.org/project/umami_analytics/releases/2.0.0-beta3 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/pivica [7] https://www.drupal.org/u/damienmckenna [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/prudloff [10] https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal....