CVE-2026-33161: Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users

A low-privileged authenticated user can call assets/image-editor with the ID of a private asset they cannot view and still receive editor response data, including focalPoint.

The endpoint returns private editing metadata without per-asset authorization validation.

Root-cause analysis:

1. actionImageEditor() accepts assetId from the request body.
2. The asset is loaded, and the focal-point data is read.
3. Response returns html and focalPoint.
4. No explicit authorization check is applied before the response.