Live › vulnerability › CVE-2026-96380
Go to dashboardThe Drupal CSS Usage Analyzer module versions 1.0.0 through 1.0.2 lack an access check, so requests can reach its pages without authorization. An attacker can view data those pages expose by browsing to them directly.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Drupal CSS Usage Analyzer module at versions 1.0.0 through 1.0.2 are exposed. The sources do not describe which data the unprotected pages return, so teams should check what the module displays on their site. Sites that do not have the module installed can skip it.
No product ranges from the sources yet.
drush pm:list --filter=css_usage_analyzer or composer show drupal/css_usage_analyzer1.0.2; the fixed version is unknown from the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-96380")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.