Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users

Summary

A low-privileged authenticated user can call assets/image-editor with the ID of a private asset they cannot view and still receive editor response data, including focalPoint.

The endpoint returns private editing metadata without per-asset authorization validation.

Root-cause analysis:

1. actionImageEditor() accepts assetId from the request body. 2. The asset is loaded, and the focal-point data is read. 3. Response returns html and focalPoint. 4. No explicit authorization check is applied before the response.

Impact

Affected deployments:

• Craft sites where asset edit metadata should remain restricted to authorized users.

Security consequence:

• Unauthorized users can extract private editor metadata and related editor context for inaccessible assets.