Security
Fixes a broken access control vulnerability (CWE-862 / CWE-639, CVSS 7.6 High): the media picker modal's per-item Delete, Download, and Edit/Save actions resolved their target Media record from client-supplied input (action arguments / the selected item) and, while gated by a global ability check, applied no per-record authorization or tenant scoping. A user holding the delete/update/download ability could act on arbitrary Media records by id — including across tenants — and the Download action streamed a client-supplied disk/path.
These actions now perform a per-record policy check and apply the picker's tenant scoping before touching a record, and Download streams from the stored record instead of the request payload. No configuration changes are required after upgrading.
See the security advisory for full details:
GHSA-3m5g-3j68-ghvp