CVE-2026-32266 in Google Cloud Storage for Craft CMS plugin
Summary
by MITRE • 03/18/2026
The Google Cloud Storage for Craft CMS plugin provides a Google Cloud Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.2.1, the `DefaultController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Users should update to version 2.2.1 of the plugin to mitigate the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 03/22/2026
The vulnerability identified as CVE-2026-32266 affects the Google Cloud Storage for Craft CMS plugin, specifically targeting versions within the 2.x branch prior to 2.2.1. This security flaw resides in the DefaultController's actionLoadBucketData endpoint, which exposes sensitive information about Google Cloud Storage buckets that the plugin has authorization to access. The issue represents a significant information disclosure vulnerability that undermines the principle of least privilege and could potentially enable attackers to enumerate cloud storage resources without proper authentication. The vulnerability is particularly concerning as it allows unauthenticated access to bucket listings when combined with a valid CSRF token, effectively bypassing standard authentication mechanisms that should protect cloud storage metadata.
The technical implementation of this vulnerability stems from improper access control validation within the plugin's controller logic. The actionLoadBucketData endpoint fails to enforce authentication requirements before returning bucket information, creating an access path that malicious actors can exploit. This flaw aligns with CWE-284, which addresses improper access control, and specifically demonstrates how insufficient authorization checks can lead to information disclosure. The vulnerability operates through a CSRF token validation mechanism that, while intended to prevent cross-site request forgery, does not sufficiently verify the identity of the requesting user. Attackers can leverage this weakness to gather intelligence about the cloud storage environment, potentially identifying accessible buckets, their configurations, and access patterns that could inform subsequent attack vectors.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with valuable reconnaissance data that could facilitate more sophisticated attacks. An attacker who obtains a valid CSRF token can enumerate all buckets accessible to the Craft CMS instance, potentially discovering sensitive data stores, backup repositories, or other cloud resources that should remain hidden from unauthorized users. This information could be used to plan targeted attacks against specific buckets, identify misconfigurations, or map out the overall cloud infrastructure landscape. The vulnerability also violates fundamental security principles by allowing unauthorized access to cloud storage metadata, which could expose sensitive organizational information about data storage practices and resource allocation patterns. According to ATT&CK framework category T1213, this vulnerability enables adversary reconnaissance activities by providing access to cloud storage information that would otherwise be protected.
Organizations utilizing the affected plugin versions face significant risks including potential data exposure, compliance violations, and increased attack surface. The vulnerability creates an attack vector that requires minimal privileges to exploit, making it particularly dangerous in environments where multiple users have access to the Craft CMS instance. Security teams should immediately implement mitigation strategies including updating to version 2.2.1 or later, which includes proper authentication checks and access controls. Additionally, organizations should review their cloud storage configurations and implement additional monitoring for unusual bucket enumeration activities. The fix addresses the root cause by implementing proper authentication verification before allowing access to bucket data, ensuring that only authorized users can retrieve sensitive cloud storage information. This remediation aligns with security best practices for cloud integration components and helps maintain the integrity of cloud storage access controls.