GHSA-67cr-jmh8-4jpqLow

Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability

Published
March 16, 2026
Last Modified
March 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-32266 →

📋 Description

Unauthenticated users can view a list of buckets the plugin has access to.

The DefaultController->actionLoadBucketData() endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see.

Users should update to version 2.2.1 of the plugin to mitigate the issue.

🎯 Affected products1

  • composer/craftcms/google-cloud:>= 2.0.0-beta.1, <= 2.2.0

🔗 References (4)