{"id":"CVE-2026-96380","kind":"vulnerability","aliases":["CVE-2026-96380"],"related":[],"title":"Drupal CSS Usage Analyzer: missing authorization lets users browse restricted pages","description":"Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2.","summary":"The Drupal CSS Usage Analyzer module versions 1.0.0 through 1.0.2 lack an access check, so requests can reach its pages without authorization. An attacker can view data those pages expose by browsing to them directly.","severity":"medium","cvss":6.5,"epss":0.00159,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["drupal","package","php","self-hosted"],"not_affected_if":["module-not-installed"],"how_to_check":"- Check the installed version of the CSS Usage Analyzer module with `drush pm:list --filter=css_usage_analyzer` or `composer show drupal/css_usage_analyzer`\n- Confirm whether the module is enabled on the site","fix":"- Upgrade the Drupal CSS Usage Analyzer module to a version newer than `1.0.2`; the fixed version is unknown from the sources\n- Disable the module until a fixed release is installed if the fixed version is not yet available","status":"open","published_at":"2026-10-22T02:17:08+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:48:38+00:00","updated_at":"2026-10-25T03:48:38+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:48:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Drupal CSS Usage Analyzer module to a version newer than `1.0.2`; the fixed version is unknown from the sources\n- Disable the module until a fixed release is installed if the fixed version is not yet available","reach":"internet","title":"Drupal CSS Usage Analyzer: missing authorization lets users browse restricted pages","impact":"low","summary":"The Drupal CSS Usage Analyzer module versions 1.0.0 through 1.0.2 lack an access check, so requests can reach its pages without authorization. An attacker can view data those pages expose by browsing to them directly.","category":"package","nicknames":[],"who_cares":["drupal","php","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Unauthorized users can view restricted module pages and their data","analyst_note":"Check the NVD entry and the Drupal security advisory for the fixed version and which pages and data are exposed.","how_to_check":"- Check the installed version of the CSS Usage Analyzer module with `drush pm:list --filter=css_usage_analyzer` or `composer show drupal/css_usage_analyzer`\n- Confirm whether the module is enabled on the site","needs_analyst":true,"not_affected_if":["module-not-installed"],"who_is_affected":"Sites running the Drupal CSS Usage Analyzer module at versions 1.0.0 through 1.0.2 are exposed. The sources do not describe which data the unprotected pages return, so teams should check what the module displays on their site. Sites that do not have the module installed can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000627,"input_tokens":3332,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-96380':14A,17A '1.0.0':31B,78C '1.0.2':33B,80C 'access':36B 'affect':72C 'allow':67C 'analyz':4A,28B,66C,75C 'attack':47B 'author':6A,45B,60C 'brows':9A,55B,69C 'check':37B 'css':2A,26B,64C,73C 'cve':12A,15A 'data':50B 'direct':58B 'drupal':1A,18B,25B,63C 'expos':53B 'forc':68C 'host':23B 'issu':71C 'lack':34B 'let':7A 'miss':5A,59C 'modul':29B 'packag':19B 'page':11A,43B,52B 'php':20B 'reach':41B 'request':39B 'restrict':10A 'self':22B 'self-host':21B 'usag':3A,27B,65C,74C 'user':8A 'version':30B,76C 'view':49B 'vulner':61C 'without':44B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Drupal CSS Usage Analyzer module at versions 1.0.0 through 1.0.2 are exposed. The sources do not describe which data the unprotected pages return, so teams should check what the module displays on their site. Sites that do not have the module installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96380","severity":null,"published_at":"2026-10-22T02:17:08+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96380","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96380","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}