Media Preview Endpoint Leaks Labels Of Non-Viewable Media By UUID

Problem/Motivation

This was originally reported as a private security issue but cleared by the security team for a public issue
Drupal's media preview endpoint accepts a caller-supplied media UUID and embeds the media label in a response header. During validation, the unpublished media item at /media/1 was not directly viewable and returned 404, but the preview endpoint still returned 200 and exposed Drupal-Media-Label: Hidden Media Label. The request only needed a text format with media_embed enabled and the expected preview header. This shows the preview code path leaks media metadata without enforcing media view access.
Impact

Any user who can reach the preview endpoint for a media-enabled text format can enumerate labels of unpublished or otherwise hidden media items when their UUIDs are known.

Relevant vulnerable code blocks:

public function preview(Request $request, FilterFormatInterface $filter_format) {
  self::checkCsrf($request, \Drupal::currentUser());

  $text = $request->query->get('text');
  $uuid = $request->query->get('uuid');
  if ($text == '' || $uuid == '') {
    throw new NotFoundHttpException();
  }

  $build = [
    '#type' => 'processed_text',
    '#text' => $text,
    '#format' => $filter_format->id(),
  ];
  $html = $this->renderer->renderInIsolation($build);

  $headers = [];
  if ($media = $this->entityRepository->loadEntityByUuid('media', $uuid)) {
    $headers['Drupal-Media-Label'] = $this->entityRepository->getTranslationFromContext($media)->label();
  }

Steps to reproduce

Proposed resolution

Add view label access check

Remaining tasks

Needs review

User interface changes

N/A

Introduced terminology

N/A

API changes

N/A

Data model changes

N/A

Release notes snippet

N/A