Anyone with a share link can RESET all website data in Umami
SummaryAnyone with a share link (permissions to view) can reset the website data.DetailsWhen a user navigates to a `/share/` URL, he receives a share token which is used for authentication. This token is later verified by `useAuth`. After the token is verified, the user can call most of the `GET` APIs that allow fetching stats about a website.The `POST /reset` endpoint is secured using `canViewWebsite` which is the incorrect verification for such destructive action. This makes it possible to completly reset all website data ONLY with view permissions - [permalink](https://github.com/umami-software/umami/blob/7bfbe264852558a148c7741f8637ff2b266d48cd/pages/api/websites/%5Bid%5D/reset.ts#L22)PoCYou can reproduce this by:Accessing a website using it's share linkCopy the `token` received from the the received from the `GET /share/{website-id}`Send a POST request to `https://analytics.umami.is/api/websites/b8250618-ccb5-47fb-8350-31c96169a198/reset` with `x-umami-share-token: ` header equal to the token copied in the previous stepThe website data is now clearedImpactEveryone with an open share link exposed to the internet!