User account form can enumerate/view all public files/images by iterating the File ID

Please also credit kaique peres who also reported the same to security.drupal.org.

Updating IS

Adding a related issue which was mentioned in the private issue queue. However to me that is not the issue here but a broader discussion.

While this is given for the user edit form, presumably this scenario impacts any form with an entity reference and thus the question would be 'should forms provide a validation of entity id's during form submission validation" (would assume this would need some version of a signed response from the server to accompany the FID to assert the user has access to the file?)

I will note the CORE Rest Route (disabled by default in standard profile, however still available) of entity/file/{file} also reveals sufficient information to obtain the files. Any proposal here should presumably take into account that aspect too.

access any public files/images on the platform without having the right to see it by... even the unpublished one and those from other users.

My understanding as a contrib streamWrapper maintainer is that if a site owner wanted to protect those files they were intended to move them into private:// to provide access controls otherwise they were to expect they could be enumerated/viewed as Drupal can not prevent the webserver from directly delivering the files.

In current scope of the limited case of images which are public, does this bug need to be critical?

Re #7, probably not, but that was the default value when creating a core security issue from the security team docs ;-).