CVE-2026-96380 in CSS Usage Analyzer Plugin
Summary
by MITRE • 10/22/2026
Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. This issue affects CSS Usage Analyzer versions: from 1.0.0 to 1.0.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The CSS Usage Analyzer module for the Drupal content management system contains a critical access control flaw that permits unauthorized users to perform forceful browsing against sensitive administrative functions. This vulnerability stems from an insufficient authorization check within the application logic, specifically affecting versions ranging from 1.0.0 through 1.0.2. In these affected releases, the module fails to properly verify whether the requesting user possesses the necessary permissions before executing operations or exposing data related to CSS analysis and site structure. This oversight allows attackers who have valid but limited credentials on the Drupal platform to bypass intended restrictions and access functionality that should be reserved for administrators or users with specific elevated privileges.
From a technical perspective, this issue is classified under CWE-284, which describes Improper Access Control, specifically manifesting as an authorization bypass where the application does not enforce proper checks before granting access to resources. The operational impact of this vulnerability is significant because it enables privilege escalation for authenticated attackers with low-level permissions. By exploiting this flaw, a malicious actor can interact with administrative endpoints or retrieve sensitive configuration data that reveals details about the website's architecture, potentially aiding in further reconnaissance and subsequent attacks such as cross-site scripting or SQL injection if other vulnerabilities are present. The ability to force browse these restricted areas undermines the security model of Drupal by allowing non-privileged users to execute actions outside their designated scope.
This vulnerability aligns with MITRE ATT&CK technique T1078, which covers Valid Accounts and specifically relates to Local Account manipulation or access using valid credentials that have been compromised or misused due to poor access controls. The exploitation does not require complex payload delivery but rather relies on the attacker simply crafting requests to endpoints that lack proper server-side validation of user roles. This simplicity makes it a high-risk issue for any Drupal site running the vulnerable module versions, as even basic automated tools can detect and exploit these misconfigurations if they are aware of the endpoint structure.
To mitigate this risk, administrators must immediately update the CSS Usage Analyzer module to version 1.0.3 or later, where the authorization checks have been corrected to ensure that only users with appropriate permissions can access sensitive functions. Until an upgrade is possible, it is advisable to restrict web server-level access to any known administrative paths associated with this module and to monitor logs for unusual activity from low-privilege accounts attempting to access restricted resources. Regular security audits and adherence to the principle of least privilege are essential practices to prevent similar authorization bypasses in future deployments.