---
id: "CVE-2026-96380"
kind: "vulnerability"
aliases: ["CVE-2026-96380"]
title: "Drupal CSS Usage Analyzer: missing authorization lets users browse restricted pages"
severity: "medium"
cvss: 6.5
epss: 0.00159
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["drupal", "package", "php", "self-hosted"]
not_affected_if: ["module-not-installed"]
published_at: "2026-10-22T02:17:08+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:48:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96380", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-96380", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Drupal CSS Usage Analyzer: missing authorization lets users browse restricted pages

The Drupal CSS Usage Analyzer module versions 1.0.0 through 1.0.2 lack an access check, so requests can reach its pages without authorization. An attacker can view data those pages expose by browsing to them directly.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the CSS Usage Analyzer module with `drush pm:list --filter=css_usage_analyzer` or `composer show drupal/css_usage_analyzer`
- Confirm whether the module is enabled on the site

## Fix

- Upgrade the Drupal CSS Usage Analyzer module to a version newer than `1.0.2`; the fixed version is unknown from the sources
- Disable the module until a fixed release is installed if the fixed version is not yet available

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96380
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-96380

## From the sources

Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_