CVE-2026-32265 in aws-s3
Summary
by MITRE • 03/18/2026
The Amazon S3 for Craft CMS plugin provides an Amazon S3 integration for Craft CMS. In versions 2.0.2 through 2.2.4, unauthenticated users can view a list of buckets the plugin has access to. The `BucketsController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Users should update to version 2.2.5 of the plugin to mitigate the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/22/2026
The vulnerability identified as CVE-2026-32265 affects the Amazon S3 for Craft CMS plugin, which serves as an integration layer between Craft CMS and Amazon S3 storage services. This plugin enables content management system administrators to store and retrieve media assets directly from AWS S3 buckets, providing seamless cloud storage functionality within the CMS environment. The affected versions 2.0.2 through 2.2.4 contain a critical security flaw in the plugin's access control mechanisms that exposes sensitive infrastructure information to unauthorized users.
The technical flaw resides within the `BucketsController->actionLoadBucketData()` endpoint which is designed to load and display bucket information for authorized users. However, the endpoint fails to properly validate user authentication status, allowing unauthenticated attackers to access bucket listing functionality when they possess a valid CSRF token. This represents a classic authorization bypass vulnerability where the system incorrectly grants access based solely on token validity rather than proper user authentication. The flaw specifically manifests as a lack of authentication checks before executing bucket enumeration operations, creating an information disclosure vulnerability that violates fundamental security principles of least privilege access.
The operational impact of this vulnerability is significant as it enables attackers to discover and enumerate all S3 buckets that the Craft CMS plugin has access to within the configured AWS environment. This information disclosure provides threat actors with valuable reconnaissance data including bucket names, potentially exposing sensitive infrastructure details that could be used for further attacks. The vulnerability affects the confidentiality aspect of the CIA security triad by allowing unauthorized information disclosure without requiring any credentials or authentication. Attackers could leverage this information to identify potentially misconfigured buckets, discover sensitive data stored in specific buckets, or plan more sophisticated attacks targeting the identified storage resources.
This vulnerability aligns with CWE-284 (Improper Access Control) and represents a failure in implementing proper authentication checks before executing sensitive operations. From an ATT&CK framework perspective, this issue maps to T1595.002 (Network Security Deviation) and T1083 (File and Directory Discovery) as it enables unauthorized information gathering and reconnaissance activities. The vulnerability also demonstrates poor input validation and access control implementation patterns that are commonly exploited in web application attacks. Organizations using the affected plugin version face increased risk of data exposure and potential privilege escalation attacks, as the bucket enumeration information could reveal system architecture details that attackers could exploit to target other components or services within the same AWS account.
The recommended mitigation strategy involves immediate upgrade to plugin version 2.2.5 which implements proper authentication checks before allowing access to bucket listing functionality. Security teams should also review existing access controls and implement additional monitoring for unauthorized access attempts to S3 buckets through the CMS interface. Organizations should conduct comprehensive security assessments of their Craft CMS installations to identify any other potentially vulnerable plugins or components that might exhibit similar authorization bypass issues. Additionally, implementing proper network segmentation and AWS security controls such as IAM policies with least privilege access can help reduce the overall impact if such vulnerabilities are exploited in other parts of the infrastructure.