High severityNVD Advisory· Published Mar 18, 2026· Updated Apr 16, 2026

CVE-2026-32268

Description

The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.1.1, unauthenticated users can view a list of buckets the plugin has access to. The DefaultController->actionLoadContainerData() endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Because Azure can return sensitive data in error messages, additional attack vectors are also exposed. Users should update to version 2.1.1 of the plugin to mitigate the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
craftcms/azure-blobPackagist	>= 2.0.0-beta.1, < 2.1.1	2.1.1

Affected products

Craftcms/Azure Blobreferences
ghsa-coords
pkg:composer/craftcms/azure-blob
Range: >= 2.0.0-beta.1, < 2.1.1

Patches

Vulnerability mechanics

References

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000