CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189

Project: CSS Usage AnalyzerProject machine name: css_usage_analyzerDate: 2026-September-23Security risk: Moderately critical 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Improper access controlAffected versions: >=1.0.0 <1.0.2CVE IDs: CVE-2026-96380Description: This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics.
This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions.Solution: Install the latest version:

• Upgrade to CSS Usage Analyzer 1.0.2.

Reported By: 

• Marcus Johansson (marcus_johansson)

Fixed By: 

• Greg Knaddison (greggles) of the Drupal Security Team
• Marcus Johansson (marcus_johansson)
• Zeeshaan khann (zeeshan_khan)

Coordinated By: 

• Swan Kalata (akalata) of the Drupal Security Team
• Bram Driesen (bramdriesen) of the Drupal Security Team
• Greg Knaddison (greggles) of the Drupal Security Team
• Juraj Nemec (poker10) of the Drupal Security Team
• Jess (xjm) of the Drupal Security Team