CVE-2026-32268

HIGH

Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability

Title source: cna

Description

The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.1.1, unauthenticated users can view a list of buckets the plugin has access to. The `DefaultController->actionLoadContainerData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Because Azure can return sensitive data in error messages, additional attack vectors are also exposed. Users should update to version 2.1.1 of the plugin to mitigate the issue.

References (2)

Core 2

Core References

X_Refsource_Confirm x_refsource_confirm

https://github.com/craftcms/azure-blob/security/advisories/GHSA-q6fm-p73f-x862

X_Refsource_Misc x_refsource_misc

https://github.com/craftcms/azure-blob/commit/cf69db45f393b3508a32f89ac8235554a2f026ff

View Writeup ZIP pw:eip

Scores

CVSS v4 8.7

EPSS 0.0035

EPSS Percentile 26.5%

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

craftcms/azure-blob 2.0.0-beta.1 - 2.1.1Packagist

craftcms/azure-blob >= 2.0.0-beta.1, < 2.1.1

Published Mar 18, 2026

Tracked Since Mar 18, 2026