CVE-2026-32265CWE-200

Amazon S3 for Craft CMS has an Information Disclosure vulnerability

Medium · published March 18, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

The Amazon S3 for Craft CMS plugin provides an Amazon S3 integration for Craft CMS. In versions 2.0.2 through 2.2.4, unauthenticated users can view a list of buckets the plugin has access to. The `BucketsController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Users should update to version 2.2.5 of the plugin to mitigate the issue.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00483 · 40.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-03-18T03:28Z
EPSS history
Timeline
  • 18 MAR 03:28Z
    Amazon S3 for Craft CMS has an Information Disclosure vulnerability
    cvelistv5