Azure Blob Storage for Craft CMS plugin contains an endpoint that allows unauthenticated users to retrieve a list of Azure Blob Storage containers (buckets) that the plugin can access, provided they supply a valid CSRF token. Because Azure can embed sensitive data in error messages, the endpoint can become an additional vector for disclosing confidential information. The vulnerability is a missing authorization flaw (CWE-862) that can lead to sensitive information disclosure.

Affected systems are installations of the Craft CMS Azure Blob Storage plugin on the 2.x branch versions older than 2.1.1. Any host running the plugin with a version prior to 2.1.1 is vulnerable.

The vulnerability carries a CVSS score of 8.7 (High). No EPSS score is publicly available, and the issue is not listed in the CISA KEV catalog. Exploitation requires only a valid CSRF token, which can be obtained through legitimate interactions or by phishing a user with site access. Once the token is presented, the attacker can enumerate buckets and potentially read error messages that may contain sensitive data. The risk is therefore moderate to high pending the presence of a CSRF token.