Matomo

Disclosure Policy

• Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
• Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.
• Reported security issues must be original and previously unreported.
• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
• Please don't run automated tools against live servers without contacting us first. If you want to test out Matomo you can easily set up your own instance
• Please don't test contact forms and similar actions that send out emails.
• Please don't sign up for more than one free trial on InnoCraft cloud.

Reporting Requirements

To help us efficiently validate and resolve issues, reports must include:

• A clear description of the vulnerability
• The affected asset, component, or plugin
• The required authentication level (e.g. unauthenticated, user, write, admin, superuser)
• Step-by-step reproduction instructions
• A working Proof of Concept (PoC) (e.g. payload, request, script, or screenshot/video demonstrating the issue)
• A clear explanation of the real-world impact

Reports that are missing sufficient detail or cannot be reproduced may be closed as Not Applicable.

Important

• Findings must be validated in a real, running Matomo instance.
• Reports based solely on code analysis, automated tools, or AI-generated output without demonstrated exploitability will not be accepted.
• The reporter is responsible for verifying that the issue is actually exploitable in practice, not just theoretically possible.
• Security vulnerabilities that have already been fixed in code, do not qualify, even if the fix did not yet land in a release.
• ==Do not report any issues listed as out-of-scope or known below. We are closing such as Not Applicable in our program.==

Out-of-Scope Vulnerabilities

The following issues are outside the scope of our rewards program. This list is not exhaustive:

• Code vulnerabilities that are not exploitable in a real-world environment
• Theoretical issues or issues based only on code patterns without a working exploit
• Output from automated scans or AI-generated reports that have not been manually verified
• Clickjacking
• Cross-Window Forgery (CWF)
• CSRF on login, logout, unauthenticated forms, or actions with no security-relevant effect
• Information disclosure that stays inside your own authorization scope, including anything already public in our open-source code (including version or path disclosures)
• The token_auth acts as the user's password and is used to authenticate in API requests (see FAQ)
• Open Directory Listing
• CORS related issues in any of our *.matomo.org websites
• Application Errors on pages
• CRIME/BEAST attack and lack of HTTP security headers (CSP, X-XSS, etc.)
• Security issues as a result of running a Matomo instance without HTTPS
• Brute force, DoS, DDoS, phishing, text injection, or social engineering attacks
• Vulnerabilities requiring Man-in-the-middle and on-path attacks; intercepting, modifying or downgrading traffic; control of DNS or the local network; user-installed root certificates
• Vulnerabilities requiring access to the victim's device, browser profile, extensions or clipboard
• Host and forwarded-header injection, including password-reset link poisoning, where it depends on proxy header settings without a header-overwriting proxy, or on trusted hosts not being configured
• Vulnerabilities requiring control of a dangling subdomain beneath a configured trusted host
• Missing cookie flags on non-sensitive cookies
• Users with super user privileges can post arbitrary JavaScript
• Vulnerabilities affecting users of outdated browsers or platforms
• Issues related to world writable files in a shared hosting environment
• Race conditions to bypass limits/quotas
• Server-Side Request Forgery (SSRF), blind and where result reaches you only as a boolean, a detection signature, an error, a timing or a length difference without further impact
• HSTS or CSP headers
• SPF or DMARC records missing; DKIM and mail server configuration
• Analytics pollution through the public tracking endpoint (whether authenticated or not)
• Issues around open ports on our servers and software running behind those
• Vulnerabilities due to outdated infrastructure (PHP, MySQL/MariaDB, web server, OS)
• Vulnerabilities caused by not applying Matomo security best practices
• Vulnerabilities in third-party plugins (not authored by Matomo or InnoCraft)
• Vulnerabilities in code not included in final releases (e.g. tests) unless they affect shipped builds
• CLI is out of scope (including Matomo console commands)

Known issues and accepted limitations

• The Matomo installer has no authentication anchor until installation completes; restricting network access to an in-progress installer is an operator responsibility
• Email address ownership is never verified, for invitations or for email changes
• Possession of an unexpired invitation link is itself the authorization to claim that pending account, as is the ability to issue or re-issue one
• In Tag Manager, the capability to publish a container live is treated as equivalent trust to authoring custom templates
• Login and password-reset responses differ for accounts that exist, including in timing
• The default password policy accepts weak passwords; strength requirements are configurable
• Matomo requires write access to its own directories for updates and plugin installation, which is not the same as an attacker holding that access
• Password-reset links follow forwarded host headers when proxy host headers are configured
• OAuth2 scopes resolve to a Matomo role rather than a list of permitted operations, so a read scope can reach state-changing methods that role may call; configuration a token creates belongs to the Matomo login and outlives the token
• Login plugins, such as LoginLdap / LoginSaml may skip the password-confirmation steps. We do not count the resulting escalation towards the severity of other reports

Deprecated / discontinued features (in-scope, but ineligible for bounties)

• Shortcodes and PHP-API mode in Connect Matomo

Additional Notes

• We may request additional information if a report is unclear or incomplete.
• Reports that require extensive clarification or cannot be reproduced may be closed.
• Repeated submission of low-quality or non-reproducible reports may negatively impact eligibility for rewards.

Responsible Disclosure Reminder

Please submit any open source security issues directly to us via HackerOne. Do not open security-related issues on public GitHub repositories.

Thank you for helping keep Matomo and our users safe!