2.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32266

CVE-2026-32266: Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability

The Google Cloud Storage for Craft CMS plugin provides a Google Cloud Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.2.1, the DefaultController->actionLoadBucketData() endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Users should update to version 2.2.1 of the plugin to mitigate the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32266

CVE-2026-32266:

2.4

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/google-cloud	composer	>= 2.0.0-beta.1, <= 2.2.0	2.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability allows unauthenticated users to list Google Cloud Storage buckets that the Craft CMS plugin has access to. The vulnerability description explicitly points to the DefaultController->actionLoadBucketData() endpoint as the source of the information disclosure. Analysis of the provided patch commit 651bacaa5f5fd7813e4075e0747b1d706391fb2c confirms this. The patch modifies the src/controllers/DefaultController.php file by adding a $this->requireAdmin(); check at the beginning of the actionLoadBucketData function. This change enforces that only authenticated administrators can execute this action. The absence of this check in vulnerable versions is the root cause of the vulnerability, as it allowed unauthenticated requests to proceed and retrieve sensitive bucket information.

Vulnerable functions

craftcms\googlecloud\controllers\DefaultController::actionLoadBucketData

src/controllers/DefaultController.php

The vulnerability is in the `actionLoadBucketData` function within the `DefaultController.php` file. Before the patch, this function did not have any authentication checks, allowing any user with a valid CSRF token to access it. The patch adds the `$this->requireAdmin();` call, which restricts access to administrators only, thus mitigating the information disclosure vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.