Craft CMS Information Disclosure Vulnerability in Asset Image Editor Endpoint

An information disclosure vulnerability has been identified in Craft CMS versions 4.0.0-RC1 prior to 4.17.8 and 5.0.0-RC1 prior to 5.9.14. The vulnerability allows low-privileged authenticated users to access private editing metadata, including focal point information, for assets they do not have permission to view. This is possible because the 'assets/image-editor' endpoint lacks proper authorization validation, enabling unauthorized access to sensitive asset editor data.

Impact

Exploitation of this vulnerability allows unauthorized users to retrieve private editing metadata and editor context for inaccessible assets, potentially leading to further privacy violations or unauthorized actions within the CMS.

Remediation

Users can upgrade to Craft CMS versions 4.17.8 or 5.9.14 to address this vulnerability.