Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The Amazon S3 for Craft CMS plugin provides an Amazon S3 integration for Craft CMS. In versions 2.0.2 through 2.2.4, unauthenticated users can view a list of buckets the plugin has access to. The `BucketsController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Users should update to version 2.2.5 of the plugin to mitigate the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-32265 Unauthenticated Bucket Disclosure in Amazon S3 for Craft CMS Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32265
Post summary
The text announces CVE‑2026‑32265, a vulnerability that permits unauthenticated disclosure of Amazon S3 buckets in the Craft CMS plugin.
⚡ New CVE Alert: CVE-2026-32265 📊 Severity: 6.9 🚨 Risk Level: Medium 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-32265 #CVE-2026-32265 #CVE #Medium #CyberSecurity #InfoSec https://t.co/DYcXeVey8z
Post summary
The tweet merely alerts about CVE-2026-32265 with generic severity details, offering no in-depth technical information, exploit details, or mitigation guidance.
CVE-2026-32265 The Amazon S3 for Craft CMS plugin provides an Amazon S3 integration for Craft CMS. In versions 2.0.2 through 2.2.4, unauthenticated users can view a list of buckets … https://www.cve.org/CVERecord?id=CVE-2026-32265
Post summary
The Amazon S3 for Craft CMS plugin is vulnerable (CVE‑2026‑32265) to unauthenticated bucket enumeration in versions 2.0.2–2.2.4; no exploit or patch details are provided.