backend/app/routers/assets.py

@@ -171,8 +171,8 @@ async def delete_asset(
 @router.post("/{asset_id}/upload", response_model=AssetResponse)
 async def upload_asset_file(
     asset_id: int,
+    current_user: CurrentUser,
     file: UploadFile = File(...),
-    current_user: CurrentUser = Depends(),
     db: AsyncSession = Depends(get_db),
 ):
     """Upload a file for an existing asset."""

backend/app/routers/worlds.py

@@ -65,6 +65,12 @@ async def list_worlds(
     # Filter by visibility if specified
     if visibility:
         query = query.where(World.visibility == visibility)
+        if visibility != WorldVisibility.PUBLIC:
+            # Requesting a non-public visibility explicitly must not bypass
+            # ownership — otherwise any authenticated user could list every
+            # PRIVATE/FRIENDS_ONLY world in the system just by passing the
+            # filter, defeating the point of the check below.
+            query = query.where(World.owner_id == current_user.id)
     else:
         # Show PUBLIC worlds + owner's own worlds
         query = query.where(