The vulnerability resides in the Google Cloud Storage for Craft CMS plugin’s DefaultController->actionLoadBucketData() endpoint. This endpoint permits unauthenticated users who possess a valid CSRF token to request and receive a list of Google Cloud Storage buckets that the plugin is configured to access. The exposure of bucket names represents a confidentiality breach, allowing an attacker to identify potential targets and gather reconnaissance information. This weakness is classified as CWE-200, indicating a failure to restrict access to sensitive information.

The affected product is the Google Cloud Storage plugin for Craft CMS, specifically the 2.x branch of the craftcms:google-cloud module prior to version 2.2.1. Users who have deployed these earlier releases on their Craft CMS sites are vulnerable.

The CVSS score for this issue is 2.4, denoting low severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The exploit requires the attacker to obtain a valid CSRF token, suggesting that the attack vector is dependent on the ability to forge or hijack a legitimate session or to perform a cross‑site request forgery. Given the limited impact and low severity rating, the overall risk to exposed sites is relatively modest, although any disclosure of bucket names can assist attackers in planning further attacks against associated cloud storage resources.