Craft CMS exposes private asset editor metadata through the "assets/image-editor" endpoint. A user who has only low privileges can supply the ID of an asset that they normally cannot view and receive an editor response containing security-sensitive information such as focalPoint. The lack of per-asset authorization validation allows the disclosure of metadata that could reveal structural details of the private asset, thereby compromising confidentiality. The weakness corresponds to improper authorization and information disclosure.

The flaw affects Craft CMS from version 4.0.0‑RC1 up to, but not including, 4.17.8, and from 5.0.0‑RC1 up to, but not including, 5.9.14. Any installation within these version ranges that still exposes the assets/image-editor route is vulnerable. The vendor is Craft CMS.

The CVSS score of 1.3 indicates a very low severity from the vendor’s perspective, and the EPSS score of less than 1% reflects a small likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread public exploitation. An attacker would need to authenticate at a lower privilege level and then craft an HTTP request to the exposed endpoint with an arbitrary asset ID. No additional conditions or exploit scripts are publicly documented, so the risk for most deployments remains minimal but should be mitigated promptly.