The vulnerability occurs in ApostropheCMS’s uploadfs module when the Azure backend is used with the sas:true setting. In versions 1.25.0 through 1.27.x, the creation of the BlobServiceClient includes the full SAS query string from the configured URL. The Azure SDK then propagates that query string to all derived client objects, causing every publicly exposed attachment URL to contain an account‑level SAS token. An attacker who observes or retrieves such a URL obtains a pre‑authenticated token that grants full access to the associated storage account, allowing read, write, and delete operations on any blob. This flaw represents an information disclosure weakness (CWE‑200) and a failure to protect sensitive data (CWE‑522).

Affected products are ApostropheCMS (apostrophe) and its uploadfs component (uploadfs). All releases from version 1.25.0 up to, but not including, 1.28.0 are vulnerable. The issue is resolved in uploadfs 1.28.0 and the corresponding ApostropheCMS release.

The CVSS base score of 5.6 indicates a moderate impact; the EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog. The attack vector is likely public exposure: any user who can access an attachment URL will see the embedded SAS token and can immediately reuse it against the Azure storage account. No additional authentication or privilege escalation is required beyond the token. The vulnerability remains actionable until the affected code is updated or the SAS usage is disabled.