Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing. (CVE-2026-96380)

CVE-2026-96380 describes a missing authorization vulnerability in the Drupal CSS Usage Analyzer module versions 1.0.0 to 1.0.2. This flaw allows unauthenticated attackers to bypass access controls and perform forceful browsing, potentially accessing restricted resources or information. The vulnerability is classified under CWE-862 (Missing Authorization). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and impacts confidentiality and integrity with low severity, but no impact on availability.

Exploitation of this vulnerability could allow an unauthenticated attacker to access resources or information that should be restricted, leading to partial confidentiality and integrity loss. There is no impact on system availability. No known exploits are reported in the wild.

No official patch or vendor advisory is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the CSS Usage Analyzer module or disable it if not required to reduce exposure.