GHSA-hwj7-4vgc-j3v9Medium

Amazon S3 for Craft CMS has an Information Disclosure vulnerability

Published
March 16, 2026
Last Modified
March 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-32265 →

📋 Description

Unauthenticated users can view a list of buckets the plugin has access to.

The BucketsController->actionLoadBucketData() endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see.

Users should update to version 2.2.5 of the plugin to mitigate the issue.

🎯 Affected products1

  • composer/craftcms/aws-s3:>= 2.0.2, <= 2.2.4

🔗 References (4)