High 8.7Published Mar 18, 2026

CVE-2026-32268Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability

Updated under an hour ago (Oct 26, 2026, 4:23 PM ET)

Does this affect you?

It affects craftcms azure-blob. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for craftcms azure-blob

Exploited in the last 30 days

The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.1.1, unauthenticated users can view a list of buckets the plugin has access to. The `DefaultController->actionLoadContainerData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Because Azure can return sensitive data in error messages, additional attack vectors are also exposed. Users should update to version 2.1.1 of the plugin to mitigate the issue.

CVSS: 8.7 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness (CWE): CWE-862
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Mar 18, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

craftcms azure-blob craftcms:azure_blob (from the name)	from 2.0.0-beta.1, < 2.1.1	CNA record

References

References

https://github.com/craftcms/azure-blob/security/advisories/GHSA-q6fm-p73f-x862	x-refsource-confirm
https://github.com/craftcms/azure-blob/commit/cf69db45f393b3508a32f89ac8235554a2f026ff	x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.