Auth bypass in Craftcms Azure-blob
CVE-2026-32268
The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.1.1, unauthenticated users can view a list of buckets the plugin has access to. The `DefaultCont…
Vulnerability class: Broken Access Control
EPSS: 0.000 (10.3th percentile) — read the EPSS interpretation.
Affected products
- Craftcms Azure-blob — versions >= 2.0.0-beta.1, < 2.1.1
Weakness classification (CWE)
References
- https://github.com/craftcms/azure-blob/security/advisories/GHSA-q6fm-p73f-x862 (x_refsource_CONFIRM)
- https://github.com/craftcms/azure-blob/commit/cf69db45f393b3508a32f89ac8235554a2f026ff (x_refsource_MISC)