{"self":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2025-10931","first":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2025-10931\u0026page=0","last":"https:\/\/www.drupal.org\/api-d7\/node?field_sa_cve=CVE-2025-10931\u0026page=0","list":[{"field_issue_status":"7","field_project":{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3285264","id":"3285264","resource":"node"},"field_sa_advisory_id":"109","field_sa_coordinated_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/damienmckenna\u0022 rel=\u0022nofollow\u0022\u003EDamien McKenna (damienmckenna)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/poker10\u0022 rel=\u0022nofollow\u0022\u003EJuraj Nemec (poker10)\u003C\/a\u003E of the Drupal Security Team\n\u003C\/li\u003E\u003Cli\u003E\u003Ca href=\u0022\/u\/prudloff\u0022 rel=\u0022nofollow\u0022\u003EPierre Rudloff (prudloff)\u003C\/a\u003E provisional member of Drupal Security Team\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_criticality":"AC:Basic\/A:Admin\/CI:Some\/II:Some\/E:Theoretical\/TD:All","field_sa_description":{"value":"\u003Cp\u003EThis module enables you to add Umami Analytics web statistics tracking system to your website.\u003C\/p\u003E\n\u003Cp\u003EThe \u0022administer umami analytics\u0022 permission allows inserting an arbitrary JavaScript file on every page. While this is an expected feature, the permission lacks the \u0022restrict access\u0022 flag, which should alert administrators that this permission is potentially dangerous and can lead to cross-site scripting (XSS) vulnerabilities.\u003C\/p\u003E\n\u003Cp\u003EThis vulnerability is mitigated by the fact that an attacker must have a role with the permission \u201cadminister umami analytics\u201d.\u003C\/p\u003E","format":"1"},"field_sa_fixed_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/pivica\u0022 rel=\u0022nofollow\u0022\u003EIvica Puljic (pivica)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_reported_by":{"value":"\u003Cul\u003E\n\u003Cli\u003E\u003Ca href=\u0022\/u\/prudloff\u0022 rel=\u0022nofollow\u0022\u003EPierre Rudloff (prudloff)\u003C\/a\u003E\n\u003C\/li\u003E\u003C\/ul\u003E","format":"1"},"field_sa_solution":{"value":"\u003Cp\u003EInstall the latest version:\u003C\/p\u003E\n\u003Cul\u003E\n\u003Cli\u003EIf you use the Umami Analytics module upgrade to Umami Analytics \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/umami_analytics\/releases\/1.0.1\u0022 rel=\u0022nofollow\u0022\u003E1.0.1\u003C\/a\u003E or \u003Ca href=\u0022https:\/\/www.drupal.org\/project\/umami_analytics\/releases\/2.0.0-beta3\u0022 rel=\u0022nofollow\u0022\u003E2.0.-beta3\u003C\/a\u003E\u003C\/li\u003E\n\u003C\/ul\u003E\n\u003Cp\u003ESites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission.\u003C\/p\u003E","format":"1"},"field_sa_type":"Cross Site Scripting","field_issue_last_status_change":"1758734853","field_sa_cve":["CVE-2025-10931"],"field_is_psa":"0","field_affected_versions":"\u003C1.0.1","field_fixed_in":[{"uri":"https:\/\/www.drupal.org\/api-d7\/node\/3548491","id":"3548491","resource":"node"}],"nid":"3548503","vid":"14130136","is_new":false,"type":"sa","title":"Umami Analytics - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-109","language":"en","url":"https:\/\/www.drupal.org\/sa-contrib-2025-109","edit_url":"https:\/\/www.drupal.org\/node\/3548503\/edit","status":"1","promote":"0","sticky":"0","created":"1758734853","changed":"1758734853","author":{"uri":"https:\/\/www.drupal.org\/api-d7\/user\/406161","id":"406161","resource":"user","name":"Drupal Security Team"},"comment":"0","comments":[{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16279552","id":16279552,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16279553","id":16279553,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16279554","id":16279554,"resource":"comment"},{"uri":"https:\/\/www.drupal.org\/api-d7\/comment\/16279555","id":16279555,"resource":"comment"}],"comment_count":0,"comment_count_new":false,"body":[],"feeds_item_guid":null,"feeds_item_url":null,"feed_nid":null,"flag_flag_tracker_follow_user":[],"flag_tracker_follower_count":null,"has_new_content":null,"last_comment_timestamp":"1758734853"}]}