CVE-2026-32268: Craft CMS Azure Blob Storage Plugin Flaw

CVE-2026-32268 Overview

CVE-2026-32268 is a Missing Authorization vulnerability (CWE-862) affecting the Azure Blob Storage plugin for Craft CMS. The vulnerability allows unauthenticated users to enumerate Azure storage containers through the DefaultController->actionLoadContainerData() endpoint when they possess a valid CSRF token. This information disclosure flaw affects versions on the 2.x branch prior to version 2.1.1.

Critical Impact

Unauthenticated attackers can view the list of Azure Blob Storage buckets accessible to the plugin, potentially exposing sensitive infrastructure information and enabling further reconnaissance attacks.

Affected Products

• Azure Blob Storage for Craft CMS versions 2.x prior to 2.1.1
• Craft CMS installations using the vulnerable Azure Blob Storage plugin

Discovery Timeline

• 2026-03-18 - CVE-2026-32268 published to NVD
• 2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-32268

Vulnerability Analysis

This vulnerability stems from missing authorization checks in the DefaultController class within the Azure Blob Storage plugin for Craft CMS. The actionLoadContainerData() method, designed to retrieve container information from Azure Blob Storage, fails to verify that the requesting user has administrative privileges before processing the request. While the endpoint requires a valid CSRF token and a POST request, these controls alone are insufficient to prevent unauthorized access since CSRF tokens can be obtained by any user with access to the application.

The exposure of Azure container names can reveal sensitive organizational information about cloud infrastructure. Additionally, because Azure may return verbose error messages containing sensitive data, this vulnerability can serve as a stepping stone for further attacks against the target infrastructure.

Root Cause

The root cause is the absence of an authorization check in the actionLoadContainerData() method. The endpoint only enforced requirePostRequest() and requireAcceptsJson() checks but lacked a requireAdmin() call to ensure only authenticated administrators could access the container listing functionality.

Attack Vector

An attacker can exploit this vulnerability by sending a crafted POST request to the actionLoadContainerData() endpoint with a valid CSRF token. The attack vector is network-based and requires no authentication or user interaction. An attacker can obtain a valid CSRF token by visiting the application and extracting the token from the page source, then use it to query the vulnerable endpoint and enumerate all Azure Blob Storage containers accessible to the plugin configuration.

// Security patch in src/controllers/DefaultController.php
// Fixed GHSA-q6fm-p73f-x862

      */
     public function actionLoadContainerData(): Response
     {
+        $this->requireAdmin();
         $this->requirePostRequest();
         $this->requireAcceptsJson();

Source: GitHub Commit Update

Detection Methods for CVE-2026-32268

Indicators of Compromise

• Unusual volume of POST requests to the actionLoadContainerData() endpoint from unauthenticated sessions
• Multiple requests to container enumeration endpoints from external IP addresses
• Access logs showing requests to Azure Blob Storage plugin endpoints without corresponding admin session cookies

Detection Strategies

• Monitor web application logs for unauthenticated access attempts to Craft CMS plugin controller endpoints
• Implement alerting for POST requests to /actions/azure-blob/default/load-container-data or similar plugin action paths from non-admin users
• Review Azure Blob Storage access logs for unexpected ListContainers API calls correlated with web application requests

Monitoring Recommendations

• Enable detailed access logging on Craft CMS to capture all requests to plugin action endpoints
• Configure Azure Storage analytics to monitor for enumeration patterns
• Set up alerts for any requests to administrative plugin functions from sessions without admin privileges

How to Mitigate CVE-2026-32268

Immediate Actions Required

• Update the Azure Blob Storage for Craft CMS plugin to version 2.1.1 or later immediately
• Audit web server access logs for evidence of exploitation attempts against the actionLoadContainerData() endpoint
• Review Azure Blob Storage access logs for unauthorized container enumeration activity

Patch Information

The vulnerability has been addressed in version 2.1.1 of the Azure Blob Storage for Craft CMS plugin. The fix adds a $this->requireAdmin() call to the actionLoadContainerData() method, ensuring only authenticated administrators can access the container listing functionality. Users should update immediately via Composer or the Craft CMS plugin store.

For additional details, refer to the GitHub Security Advisory and the security patch commit.

Workarounds

• If immediate patching is not possible, consider temporarily disabling the Azure Blob Storage plugin until the update can be applied
• Implement web application firewall (WAF) rules to block unauthenticated requests to plugin action endpoints
• Restrict network access to the Craft CMS administrative interface to trusted IP addresses only

# Configuration example for restricting access via .htaccess
<Location "/actions/azure-blob/">
    Require ip 192.168.1.0/24
    Require ip 10.0.0.0/8
</Location>