GitHub Advisoryadvisory · Packagist

GHSA-67cr-jmh8-4jpq Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability

LOW Published 2026-03-16 Modified 2026-03-19 Official page ↗
Aliases
CVE-2026-32266
Ecosystem
Packagist
Packages
craftcms/google-cloud
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:U
Weaknesses
CWE-200
Reviewed
2026-03-16

Affected packages

• Packagist craftcms/google-cloud: >= 2.0.0-beta.1, < 2.2.1 → fixed in 2.2.1

Description

Unauthenticated users can view a list of buckets the plugin has access to. The `DefaultController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Users should update to version 2.2.1 of the plugin to mitigate the issue.

Related

Alias · CVE (1)

  • CVE-2026-32266 The Google Cloud Storage for Craft CMS plugin provides a Google Cloud Storage integration for Craft CMS. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References