AIKIDO-2026-889866

TL;DR

The admin API's MediaPreviewController and MediaFormatController implement no secured controller interface, so SuluSecurityListener skips them and neither controller checks permissions on its own. Any authenticated admin user can set, replace, or remove a media's preview image and read or change its crop settings, including media in collections the user cannot otherwise access, by supplying an arbitrary media id; the preview endpoints also return the media's title, description, copyright, and tags. The fix adds a sulu.media.collections permission check against the media's real collection, requiring edit to change the preview image or crop settings and view to read crop settings.