CVE-2026-32266: 
PHP vulnerability analysis and mitigation

CVE-2026-32266 is an information disclosure vulnerability in the Google Cloud Storage plugin for Craft CMS (craftcms/google-cloud) that allows unauthenticated users to enumerate Google Cloud Storage buckets accessible to the plugin. The vulnerability affects plugin versions >= 2.0.0-beta.1 through <= 2.2.0 and was disclosed on March 16, 2026, with a patch published the same day. It carries a CVSS v4 base score of 2.4 (Low) (GitHub Advisory).

The root cause is a missing authentication check on the DefaultController->actionLoadBucketData() endpoint (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). The endpoint accepted POST requests from unauthenticated users as long as a valid CSRF token was supplied, which could be obtained by any visitor to the site. The fix, applied in commit 651baca, adds a single $this->requireAdmin() call before the existing requirePostRequest() check, enforcing that only authenticated administrators can invoke the endpoint (GitHub Commit, GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to retrieve a list of all Google Cloud Storage bucket names that the plugin is configured to access. While no data within the buckets is directly exposed, bucket name enumeration can facilitate reconnaissance for further attacks — such as targeted data exfiltration attempts, bucket misconfiguration probing, or social engineering. There is no integrity or availability impact; the vulnerability is limited to confidentiality of infrastructure metadata (GitHub Advisory).

No public exploit code or active in-the-wild exploitation has been reported. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires obtaining a valid CSRF token from the target site, which is a low barrier for any visitor but does add a minor precondition (GitHub Advisory).

1. Reconnaissance: Identify a Craft CMS site running the craftcms/google-cloud plugin version >= 2.0.0-beta.1 and <= 2.2.0 (e.g., by inspecting HTTP response headers, composer.json exposure, or plugin-specific URL patterns).
2. Obtain CSRF token: Visit any page on the target Craft CMS site and extract the CSRF token from the page source or a cookie (Craft CMS typically embeds a CSRF token in page HTML or provides it via a dedicated endpoint).
3. Craft malicious POST request: Send an HTTP POST request to the DefaultController->actionLoadBucketData() endpoint (e.g., /actions/google-cloud/default/load-bucket-data) with the extracted CSRF token included in the request headers or body, and an Accept: application/json header.
4. Retrieve bucket list: Parse the JSON response, which will contain the names of all Google Cloud Storage buckets the plugin is configured to access, enabling further targeted reconnaissance (GitHub Advisory, GitHub Commit).

• Network: Unexpected POST requests to /actions/google-cloud/default/load-bucket-data (or equivalent action path) originating from unauthenticated or anonymous sessions.
• Logs: Craft CMS access logs showing POST requests to the google-cloud/default/load-bucket-data action from IP addresses not associated with administrative users, particularly with a valid CSRF token and Accept: application/json header.
• Logs: Repeated or automated requests to the bucket data endpoint from a single IP or user agent in a short time window, suggesting automated scanning.

Update the craftcms/google-cloud Composer package to version 2.2.1 or later, which adds an $this->requireAdmin() check to the actionLoadBucketData() endpoint. No configuration-based workaround is available for unpatched versions; upgrading is the only remediation. Administrators can also restrict access to Craft CMS action endpoints at the web server or firewall level as a temporary measure while planning the upgrade (GitHub Advisory, GitHub Commit).