GHSA-vgjg-248p-rfm2

### Summary A low-privileged authenticated user can call `assets/image-editor` with the ID of a private asset they cannot view and still receive editor response data, including `focalPoint`. The endpoint returns private editing metadata without per-asset authorization validation. Root-cause analysis: 1. `actionImageEditor()` accepts `assetId` from the request body. 2. The asset is loaded, and the focal-point data is read. 3. Response returns `html` and `focalPoint`. 4. No explicit authorization check is applied before the response. ### Impact ## Affected deployments: * Craft sites where asset edit metadata should remain restricted to authorized users. ## Security consequence: * Unauthorized users can extract private editor metadata and related editor context for inaccessible assets.