low2.4
CVE-2026-32266
Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability
Impact
Unauthenticated users can view a list of buckets the plugin has access to. The `DefaultController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Users should update to version 2.2.1 of the plugin to mitigate the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | craftcms/google-cloud | >= 2.0.0-beta.1, <= 2.2.0 | 2.2.1 |
Affected products
| Product | Affected versions |
|---|---|
| Versions On The 2.X Branch | before 2.2.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/craftcms/google-cloud/commit/651bacaa5f5fd7813e4075e0747b1d706391fb2c
- https://github.com/craftcms/google-cloud/security/advisories/GHSA-67cr-jmh8-4jpq
- https://github.com/advisories/GHSA-67cr-jmh8-4jpq
- https://nvd.nist.gov/vuln/detail/CVE-2026-32266