GHSA-vgjg-248p-rfm2 Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users

• Packagist craftcms/cms: >= 5.0.0-RC1, < 5.9.14 → fixed in 5.9.14 • Packagist craftcms/cms: >= 4.0.0-RC1, < 4.17.8 → fixed in 4.17.8

Summary A low-privileged authenticated user can call `assets/image-editor` with the ID of a private asset they cannot view and still receive editor response data, including `focalPoint`. The endpoint returns private editing metadata without per-asset authorization validation. Root-cause analysis: 1. `actionImageEditor()` accepts `assetId` from the request body. 2. The asset is loaded, and the focal-point data is read. 3. Response returns `html` and `focalPoint`. 4. No explicit authorization check is applied before the response. Impact Affected deployments: • Craft sites where asset edit metadata should remain restricted to authorized users. Security consequence: • Unauthorized users can extract private editor metadata and related editor context for inaccessible assets.