What is GHSA-q6fm-p73f-x862?

GHSA-q6fm-p73f-x862 is a security advisory published by GitHub Security Advisories with High severity. Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability

Which CVE IDs does GHSA-q6fm-p73f-x862 cover?

GHSA-q6fm-p73f-x862 covers the following CVE IDs: CVE-2026-32268. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-q6fm-p73f-x862?

GHSA-q6fm-p73f-x862 affects 1 product, including: composer/craftcms/azure-blob:\u003e= 2.0.0-beta.1, \u003c= 2.1.0.

GHSA-q6fm-p73f-x862High

Azure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability

Vendor

GitHub Security Advisories

Published

March 16, 2026

Last Modified

March 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-32268 →

📋 Description

Unauthenticated users can view a list of buckets the plugin has access to.

The DefaultController->actionLoadContainerData() endpoint allows unauthenticated users with a valid CSRF token to view a list of buckets that the plugin is allowed to see.

Because Azure can return sensitive data in error messages, additional attack vectors are also exposed.

Users should update to version 2.1.1 of the plugin to mitigate the issue.

🎯 Affected products1

composer/craftcms/azure-blob:>= 2.0.0-beta.1, <= 2.1.0

🔗 References (4)

https://github.com/craftcms/azure-blob/security/advisories/GHSA-q6fm-p73f-x862
https://github.com/craftcms/azure-blob/commit/cf69db45f393b3508a32f89ac8235554a2f026ff
https://nvd.nist.gov/vuln/detail/CVE-2026-32268
https://github.com/advisories/GHSA-q6fm-p73f-x862