PT-2026-25818 · Craft Cms+1 · Craft Cms+1

Neosprings · Published 2026-03-16 · Updated 2026-03-18 · CVE-2026-32268

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Azure Blob Storage for Craft CMS plugin versions prior to 2.1.1

Description The Azure Blob Storage for Craft CMS plugin integrates Azure Blob Storage with Craft CMS. Versions prior to 2.1.1 allow unauthenticated users to view a list of buckets the plugin has access to. The /DefaultController->actionLoadContainerData() API endpoint permits unauthenticated users possessing a valid CSRF token to enumerate accessible buckets. Due to the potential for sensitive data exposure in Azure error messages, additional attack vectors may be present.

Recommendations Update to version 2.1.1 of the plugin.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-32268

GHSA-Q6FM-P73F-X862

Affected Products

Azure Blob Storage For Craft Cms

Craft Cms

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32268.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32268 · Security Note
• https://osv.dev/vulnerability/GHSA-q6fm-p73f-x862 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-32268 · Vendor Advisory
• https://github.com/craftcms/azure-blob/commit/cf69db45f393b3508a32f89ac8235554a2f026ff · Note
• https://github.com/craftcms/azure-blob/security/advisories/GHSA-q6fm-p73f-x862 · Note
• https://github.com/craftcms/azure-blob · Note
• https://twitter.com/cyberbivash/status/2034167401525215613 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1rvkawc/resumen_diario_de_vulnerabilidades_16032026 · Reddit Post
• https://twitter.com/VulmonFeeds/status/2034252797609132412 · Twitter Post