Information disclosure in Craftcms Google-Cloud
CVE-2026-32266
The Google Cloud Storage for Craft CMS plugin provides a Google Cloud Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.2.1, the `DefaultController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Users should update to version 2.2.1 of the plugin to mitigate the issue.
Vulnerability class: Information Disclosure
EPSS: 0.003 (26.9th percentile) — read the EPSS interpretation.
Affected products
- Craftcms Google-cloud — versions >= 2.0.0-beta.1, < 2.2.1
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)