Low severity · published Mar 18, 2026
CVE-2026-32266
Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability
2.4
CVSS
0.4%
EPSS
No
On KEV
Description
The Google Cloud Storage for Craft CMS plugin provides a Google Cloud Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.2.1, the `DefaultController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Users should update to version 2.2.1 of the plugin to mitigate the issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
google-cloud · craftcms
>= 2.0.0-beta.1, < 2.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-32266
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-32266
github.com
https://github.com/craftcms/google-cloud/commit/651bacaa5f5fd7813e4075e0747b1d706391fb2c
github.com
https://github.com/craftcms/google-cloud/security/advisories/GHSA-67cr-jmh8-4jpq