CVE-2026-32266: Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability

March 16, 2026 (updated March 19, 2026)

Unauthenticated users can view a list of buckets the plugin has access to.

The DefaultController->actionLoadBucketData() endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see.

Users should update to version 2.2.1 of the plugin to mitigate the issue.

References

github.com/advisories/GHSA-67cr-jmh8-4jpq
github.com/craftcms/google-cloud
github.com/craftcms/google-cloud/commit/651bacaa5f5fd7813e4075e0747b1d706391fb2c
github.com/craftcms/google-cloud/security/advisories/GHSA-67cr-jmh8-4jpq
nvd.nist.gov/vuln/detail/CVE-2026-32266

Code Behaviors & Features

Detect and mitigate CVE-2026-32266 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →