GHSA-hvp5-pwxx-2752: 
PHP vulnerability analysis and mitigation

It is possible for an unauthorized user to browse volumes for which they do not have permissions. Note that they cannot see files, but they can browse entire directory structures.

1. Create a number of volumes and upload some assets into them
2. Create a new user with access to 1 of those volumes
3. Create an entry type with an asset field, and create a new entry with an asset in the volume that the user can access
4. Log in as the new user
5. Attempt to delete the linked asset from the asset browser
6. When prompted to select a replacement, the modal showing the volume browser displays all available volumes regardless of access permissions and allows the user to browse directory structures

Impact

An unauthorized user can view the directory structures of all volumes. Report ID: 1839