PT-2026-25843 · Packagist · Craftcms/Google-Cloud

Published 2026-03-16 · Updated 2026-03-16 · CVE-2026-32266

OSV

Unauthenticated users can view a list of buckets the plugin has access to.

The

DefaultController->actionLoadBucketData()

endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see.

Users should update to version 2.2.1 of the plugin to mitigate the issue.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-32266

GHSA-67CR-JMH8-4JPQ

Affected Products

Craftcms/Google-Cloud

References · 4

• https://osv.dev/vulnerability/GHSA-67cr-jmh8-4jpq · Vendor Advisory
• https://github.com/craftcms/google-cloud · Note
• https://github.com/craftcms/google-cloud/security/advisories/GHSA-67cr-jmh8-4jpq · Note
• https://github.com/craftcms/google-cloud/commit/651bacaa5f5fd7813e4075e0747b1d706391fb2c · Note