CVE-2026-32266

LOW

Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability

Title source: cna
STIX 2.1

Description

The Google Cloud Storage for Craft CMS plugin provides a Google Cloud Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.2.1, the `DefaultController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Users should update to version 2.2.1 of the plugin to mitigate the issue.

References (2)

Scores

CVSS v4 2.4
EPSS 0.0003
EPSS Percentile 9.6%
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:U

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (2)
craftcms/google-cloud 2.0.0-beta.1 - 2.2.1Packagist
craftcms/google-cloud >= 2.0.0-beta.1, < 2.2.1
Published Mar 18, 2026
Tracked Since Mar 18, 2026