CVE-2026-32268

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32268", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-11T15:05:48.398Z", "datePublished": "2026-03-18T04:53:03.746Z", "dateUpdated": "2026-03-18T17:22:59.072Z"}, "containers": {"cna": {"title": "Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/craftcms/azure-blob/security/advisories/GHSA-q6fm-p73f-x862", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/craftcms/azure-blob/security/advisories/GHSA-q6fm-p73f-x862"}, {"name": "https://github.com/craftcms/azure-blob/commit/cf69db45f393b3508a32f89ac8235554a2f026ff", "tags": ["x_refsource_MISC"], "url": "https://github.com/craftcms/azure-blob/commit/cf69db45f393b3508a32f89ac8235554a2f026ff"}], "affected": [{"vendor": "craftcms", "product": "azure-blob", "versions": [{"version": ">= 2.0.0-beta.1, < 2.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T04:53:03.746Z"}, "descriptions": [{"lang": "en", "value": "The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.1.1, unauthenticated users can view a list of buckets the plugin has access to. The `DefaultController->actionLoadContainerData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Because Azure can return sensitive data in error messages, additional attack vectors are also exposed. Users should update to version 2.1.1 of the plugin to mitigate the issue."}], "source": {"advisory": "GHSA-q6fm-p73f-x862", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-18T17:22:41.863136Z", "id": "CVE-2026-32268", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T17:22:59.072Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32268", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-18T17:22:41.863136Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-18T17:22:51.449Z"}}], "cna": {"title": "Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability", "source": {"advisory": "GHSA-q6fm-p73f-x862", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "craftcms", "product": "azure-blob", "versions": [{"status": "affected", "version": ">= 2.0.0-beta.1, < 2.1.1"}]}], "references": [{"url": "https://github.com/craftcms/azure-blob/security/advisories/GHSA-q6fm-p73f-x862", "name": "https://github.com/craftcms/azure-blob/security/advisories/GHSA-q6fm-p73f-x862", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/craftcms/azure-blob/commit/cf69db45f393b3508a32f89ac8235554a2f026ff", "name": "https://github.com/craftcms/azure-blob/commit/cf69db45f393b3508a32f89ac8235554a2f026ff", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.1.1, unauthenticated users can view a list of buckets the plugin has access to. The `DefaultController->actionLoadContainerData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Because Azure can return sensitive data in error messages, additional attack vectors are also exposed. Users should update to version 2.1.1 of the plugin to mitigate the issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-18T04:53:03.746Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32268", "state": "PUBLISHED", "dateUpdated": "2026-03-18T17:22:59.072Z", "dateReserved": "2026-03-11T15:05:48.398Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-18T04:53:03.746Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "azure-blob", "vendor": "craftcms", "versions": [{"status": "affected", "version": ">= 2.0.0-beta.1, < 2.1.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.1.1, unauthenticated users can view a list of buckets the plugin has access to. The `DefaultController->actionLoadContainerData()` endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see. Because Azure can return sensitive data in error messages, additional attack vectors are also exposed. Users should update to version 2.1.1 of the plugin to mitigate the issue."}, {"lang": "es", "value": "El plugin Azure Blob Storage para Craft CMS proporciona una integraci\u00f3n de Azure Blob Storage para Craft CMS. En versiones de la rama 2.x anteriores a la 2.1.1, los usuarios no autenticados pueden ver una lista de buckets a los que el plugin tiene acceso. El endpoint `DefaultController-&gt;actionLoadContainerData()` permite a usuarios no autenticados con un token CSRF v\u00e1lido ver una lista de buckets que el plugin tiene permitido ver. Debido a que Azure puede devolver datos sensibles en mensajes de error, tambi\u00e9n se exponen vectores de ataque adicionales. Los usuarios deben actualizar a la versi\u00f3n 2.1.1 del plugin para mitigar el problema."}], "id": "CVE-2026-32268", "lastModified": "2026-06-17T10:35:27.453", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32268", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-18T17:22:41.863136Z", "version": "2.0.3"}}]}, "published": "2026-03-18T06:16:17.827", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/craftcms/azure-blob/commit/cf69db45f393b3508a32f89ac8235554a2f026ff"}, {"source": "security-advisories@github.com", "url": "https://github.com/craftcms/azure-blob/security/advisories/GHSA-q6fm-p73f-x862"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0-beta.1,2.1.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "azure-blob", "source": "cna", "vendor": "craftcms"}, "product": "azure-blob", "vendor": "craftcms"}], "analysis": {"en": {"generated_at": "2026-03-18T06:20:58.043610+00:00", "value": {"mitigation_remediation": ["Apply plugin update to version 2.1.1 or newer"], "summary": {"action": "Update Plugin", "impact": "Sensitive Information Disclosure"}, "threat_synthesis": {"affected_systems": "Affected systems are installations of the Craft CMS Azure Blob Storage plugin on the 2.x branch versions older than 2.1.1. Any host running the plugin with a version prior to 2.1.1 is vulnerable.", "description_and_impact": "Azure Blob Storage for Craft CMS plugin contains an endpoint that allows unauthenticated users to retrieve a list of Azure Blob Storage containers (buckets) that the plugin can access, provided they supply a valid CSRF token. Because Azure can embed sensitive data in error messages, the endpoint can become an additional vector for disclosing confidential information. The vulnerability is a missing authorization flaw (CWE-862) that can lead to sensitive information disclosure.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 8.7 (High). No EPSS score is publicly available, and the issue is not listed in the CISA KEV catalog. Exploitation requires only a valid CSRF token, which can be obtained through legitimate interactions or by phishing a user with site access. Once the token is presented, the attacker can enumerate buckets and potentially read error messages that may contain sensitive data. The risk is therefore moderate to high pending the presence of a CSRF token."}}}}, "created": "2026-03-18T10:41:49.776532+00:00", "updated": "2026-03-24T10:59:19.032791+00:00", "vendors": ["craftcms", "craftcms$PRODUCT$azure-blob"]}