PatchClock

PHP security digest · 23 Sep 2026

This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently pr...

Unrated CVE-2026-96380

Package
drupal/css_usage_analyzer
Fixed in
1.0.2
Published
Wed 23 Sep 2026, 18:22 LisbonUpdated Mon 26 Oct 2026, 01:27 Lisbon

In plain words

An attacker can make forged or repeated submissions to the CSS Usage Analyzer module's /css-usage-analyzer/save endpoint because it is not sufficiently protected. This endpoint receives CSS-usage measurements from a frontend scanner for use in admin reports.

Am I affected?

Look for drupal/css_usage_analyzer and its version in composer.lock. The advisory lists 1.0.2 as fixed but gives no affected version range, so it does not establish which other versions are affected. No configuration or database condition is named, so the installed package version is all there is to check.

What to do

Check which version you have, then update to a fixed release for your branch (1.0.2):

composer show drupal/css_usage_analyzer | grep versions
composer update drupal/css_usage_analyzer

If your version constraint in composer.json keeps you below a fixed release, raise it first. Whether your configuration is affected, and the exact version ranges, are in the advisory itself.

The advisory's description

This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics.

This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions.

The advisory

From OSV.dev, which gathers the GitHub Advisory Database, FriendsOfPHP and Drupal security advisories; the summary is theirs. The description is OSV's record of the advisory. "In plain words", "Am I affected?" and "If you cannot update yet" are based on that advisory, and checked to name no version it does not.