CSS Usage Analyzer CVE-2026-96380

The prerequisite is that the CSS Usage Analyzer module (versions 1.0.0 through 1.0.2) is installed and enabled on an internet-reachable Drupal site; the flaw is a missing authorization check (CWE-862) that lets an attacker perform forceful browsing - directly requesting a module resource/URL that should be access-restricted - without authentication (PR:N). Limiting factors: the supplied CVSS vector specifies UI:R (some user interaction required) and impact is confined to Low confidentiality and Low integrity with no availability effect; the exact feature, path, or configuration that must be present to trigger the issue is not described in the available sources.

This is a moderate-severity (CVSS 5.4) Missing Authorization flaw (CWE-862) in the Drupal contrib module CSS Usage Analyzer. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) indicates network-reachable, low-complexity exploitation requiring no privileges (PR:N, so unauthenticated) but some user interaction (UI:R), with only Low confidentiality and integrity impact and no availability impact. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no public evidence of exploitation; the only priority signal is the vuln.today Decision label 'this_month', which is consistent with a patch-when-convenient issue rather than an emergency. One tension worth flagging: forceful browsing via missing authorization is typically a direct-request condition that would not require user interaction, yet the supplied vector asserts UI:R - the trigger is not described in the available sources, so this UI:R assumption should be verified against the Drupal advisory. Net: a real but non-urgent, lower-impact authorization bug in a niche contrib module, not a high-risk-but-low-real-risk mislabel nor an actively exploited priority.

A remote, unauthenticated attacker directly requests a resource or endpoint exposed by the CSS Usage Analyzer module that should have been access-controlled, and because the authorization check is missing, obtains or alters limited data (C:L/I:L). No public exploit code is identified, and the CVSS vector indicates some user interaction may be involved; the exact feature or URL that is triggerable is not described in the available sources.