Description

Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users

Summary

A low-privileged authenticated user can call assets/image-editor with the ID of a private asset they cannot view and still receive editor response data, including focalPoint.

The endpoint returns private editing metadata without per-asset authorization validation.

Root-cause analysis:

actionImageEditor() accepts assetId from the request body.

The asset is loaded, and the focal-point data is read.

Response returns html and focalPoint.

No explicit authorization check is applied before the response.

Affected deployments:

Craft sites where asset edit metadata should remain restricted to authorized users.

Security consequence:

Unauthorized users can extract private editor metadata and related editor context for inaccessible assets.

Mitigation

Aliases

References