PT-2026-25843 · WordPress+1 · Google Cloud Storage For Craft Cms+1

Angrybrad · Published 2026-03-16 · Updated 2026-03-18 · CVE-2026-32266

Positive Technologies (AI Summary)

CVSS v4.0

2.4

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Google Cloud Storage for Craft CMS plugin versions prior to 2.2.1

Description The Google Cloud Storage for Craft CMS plugin integrates Google Cloud Storage with Craft CMS. Versions of the plugin on the 2.x branch prior to 2.2.1 allow unauthenticated users possessing a valid CSRF token to view a list of buckets the plugin has access to via the DefaultController->actionLoadBucketData() API endpoint. The DefaultController->actionLoadBucketData() endpoint is vulnerable.

Recommendations Update the plugin to version 2.2.1.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-32266

GHSA-67CR-JMH8-4JPQ

Affected Products

Craft Cms

Google Cloud Storage For Craft Cms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32266.json · Exploit
• https://osv.dev/vulnerability/GHSA-67cr-jmh8-4jpq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32266 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32266 · Vendor Advisory
• https://github.com/craftcms/google-cloud/security/advisories/GHSA-67cr-jmh8-4jpq · Note
• https://github.com/craftcms/google-cloud/commit/651bacaa5f5fd7813e4075e0747b1d706391fb2c · Note
• https://github.com/craftcms/google-cloud · Note
• https://twitter.com/CVEarity/status/2034162508483989808 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034265597874163794 · Twitter Post