The CSS Usage Analyzer extension for Drupal contains a missing authorization flaw that permits forced browsing of protected resources. An attacker can construct URLs to retrieve content normally hidden behind authentication or role checks, potentially exposing sensitive configuration or user data. The underlying weakness corresponds to improper access control, as defined by CWE‑862.

Drupal CSS Usage Analyzer versions 1.0.0 through 1.0.2 are affected. Systems running these versions should review their deployment of the extension and verify if they are vulnerable.

The CVSS score is 6.5, indicating a moderate severity. The EPSS score indicates a very low exploitation probability (<1%). The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the vulnerability could be exploited remotely via HTTP requests, though the exact attack conditions, such as whether the attacker requires authentication or specific roles, are not explicitly detailed. The potential impact includes compromise of confidentiality for protected content.