CVE-2026-32268 in azure-blob
Summary
by MITRE • 03/18/2026
The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.1.1, unauthenticated users can view a list of buckets the plugin has access to. The `DefaultController->actionLoadContainerData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Because Azure can return sensitive data in error messages, additional attack vectors are also exposed. Users should update to version 2.1.1 of the plugin to mitigate the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 03/22/2026
The vulnerability identified as CVE-2026-32268 affects the Azure Blob Storage plugin for Craft CMS, specifically targeting versions within the 2.x branch prior to 2.1.1. This issue represents a critical information disclosure flaw that exposes sensitive cloud storage metadata to unauthorized users. The vulnerability resides in the DefaultController's actionLoadContainerData() endpoint, which serves as an entry point for retrieving Azure Blob Storage container information without proper authentication requirements.
The technical flaw stems from insufficient access controls within the plugin's controller implementation, allowing unauthenticated users to exploit the endpoint when provided with a valid CSRF token. This represents a classic authentication bypass vulnerability where the system fails to verify user credentials before executing sensitive operations. The flaw operates under CWE-285, which addresses insufficient authorization in software systems, and aligns with ATT&CK technique T1213.002 for data from information repositories. The endpoint's design permits any user with knowledge of the CSRF token to enumerate storage containers, effectively creating a reconnaissance vector for potential attackers.
The operational impact of this vulnerability extends beyond simple information disclosure, as Azure Blob Storage error responses can contain sensitive metadata about the storage environment. This additional exposure creates multiple attack vectors where adversaries can gather intelligence about the cloud infrastructure, storage naming conventions, and potentially identify other vulnerable components within the same Azure environment. The vulnerability essentially provides an attacker with a map of accessible storage resources, enabling more targeted and effective subsequent attacks against the affected system.
Organizations using the affected plugin versions face significant security risks, as the vulnerability allows for automated enumeration of storage containers without requiring authentication credentials. This exposure can facilitate advanced persistent threat campaigns where attackers systematically map cloud storage resources to identify potential data repositories containing sensitive information. The remediation strategy requires immediate deployment of plugin version 2.1.1, which implements proper authentication checks and authorization controls. Security teams should also conduct comprehensive audits of their cloud storage configurations and implement network segmentation to limit access to storage endpoints, while monitoring for potential exploitation attempts through unusual data enumeration patterns.