Vulnerability · Published Mar 18, 2026 · Assigned by GitHub_M
CVE-2026-32268Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability
High 8.7
In plain English
A high-severity missing authorization in azure-blob from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.1.1, unauthenticated users can view a list of buckets the plugin has access to. The `DefaultController->actionLoadContainerData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Because Azure can return sensitive data in error messages, additional attack vectors are also exposed. Users should update to version 2.1.1 of the plugin to mitigate the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | craftcms/azure-blob | 2.1.1 | GHSA-q6fm-p73f-x862 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| craftcms | azure-blob | >= 2.0.0-beta.1, < 2.1.1 |
Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N