SA-CONTRIB-2026-189: Critical severity drupal/css_usage_analyzer vulnerability
Published Sep 23, 2026
·Updated
This module lets a frontend scanner post CSS-usage measurements to the site so admin reports can show real-page statistics. This module doesn't sufficiently protect the /css-usage-analyzer/save endpoint against forged or repeated submissions.
Credit
Marcus Johansson (marcus_johansson)
Affected Software
1 affected componentFixes available
drupal/css_usage_analyzer<1.0.2
1.0.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
drupal/css_usage_analyzerto a version that resolves this vulnerability.Fixed in 1.0.2
Event History
Sep 23, 2026
Advisory Published
via Drupal·12:00 AM
Data Sourced
via Drupal·12:00 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What operational impact should administrators expect from exploitation?
CSS-usage measurements submitted to the site can be forged or replayed, which can make admin reports show unreliable real-page statistics.
2
Which endpoint should be reviewed when assessing exposure?
Review the /css-usage-analyzer/save endpoint, which receives CSS-usage measurements from the frontend scanner.