CVE-2026-32266

LOW

Craft CMS Google Cloud Storage <2.2.1 - Bucket List Disclosure

Title source: manual

Description

The Google Cloud Storage for Craft CMS plugin provides a Google Cloud Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.2.1, the `DefaultController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Users should update to version 2.2.1 of the plugin to mitigate the issue.

References (2)

Core 2

Core References

X_Refsource_Confirm x_refsource_confirm

https://github.com/craftcms/google-cloud/security/advisories/GHSA-67cr-jmh8-4jpq

X_Refsource_Misc x_refsource_misc

https://github.com/craftcms/google-cloud/commit/651bacaa5f5fd7813e4075e0747b1d706391fb2c

View Writeup ZIP pw:eip

Scores

CVSS v4 2.4

EPSS 0.0034

EPSS Percentile 26.0%

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:U

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-200

Status published

Products (2)

craftcms/google-cloud 2.0.0-beta.1 - 2.2.1Packagist

craftcms/google-cloud >= 2.0.0-beta.1, < 2.2.1

Published Mar 18, 2026

Tracked Since Mar 18, 2026