The Amazon S3 for Craft CMS plugin suffered an information disclosure flaw (CWE-200). In affected versions 2.0.2 through 2.2.4, the BucketsController->actionLoadBucketData() endpoint allowed unauthenticated users who possessed a valid CSRF token to retrieve a list of S3 buckets the plugin could access. This could expose the names of storage buckets, potentially aiding attackers in reconnaissance and further exploit attempts.

Users running the Craft CMS amazon-s3 plugin version 2.0.2, 2.1.x, or 2.2.4 are vulnerable. The issue is specific to the aws-s3 plugin for Craft CMS and does not affect other Craft CMS components.

The CVSS score of 6.9 indicates a moderate severity vulnerability. EPSS data is unavailable and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited evidence of exploitation in the wild. The likely attack vector is client‑side via a legitimate session that has a CSRF token; an attacker would need to navigate the site or trick a user into generating a token, after which the bucket list can be retrieved without authentication. Although the exposure does not compromise the S3 buckets themselves, it leaks potentially sensitive inventory data and could assist further attacks.