Pimcore vulnerable to disclosure of system and database information behind /admin firewall

@@ -790,6 +790,7 @@ there_are_more_items: 'There are more items than displayed'
 workflow_actions: Actions
 workflow_notes_requred_field_message: '"%s" is a required field.'
 workflow_transition_applied_successfully: 'Action applied successfully'
+workflow_transition_unsaved_data: 'Your data changes have not been saved yet. Please, save changes before applying workflow transition.'
 workflow_change_email_notification_subject: "Workflow update for %s in workflow '%s'"
 workflow_details: 'Workflow Details'
 workflow_graph: 'Workflow Graph'
@@ -1020,4 +1021,4 @@ female: Female
 pdf_js_unsafe: This PDF file contains JavaScript. If you want to view it, please download and open it in your local PDF viewer.
 pdf_scan_in_progress: 'Preview not available: PDF is being scanned. This may take a while.'
 invalid_option: 'Invalid Option field [ {field} ]: Please choose a valid option for select / multiselect field [ {field} ]. Current value: "{option}"'
-respect_timezone: 'Respect timezone'
\ No newline at end of file
+respect_timezone: 'Respect timezone'

@@ -18,6 +18,12 @@ services:
         public: true
         tags: ['controller.service_arguments']
 
+    Pimcore\Bundle\AdminBundle\Controller\Admin\IndexController:
+        public: true
+        arguments:
+            $httpClient: '@pimcore.http_client'
+        tags: [ 'controller.service_arguments' ]
+
     #
     # COMMANDS
     #

@@ -562,19 +562,21 @@ Ext.onReady(function () {
                     request.open('GET', Routing.generate('pimcore_admin_index_statistics'));
                     request.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
 
-                    request.onload = function () {
-                        if (this.status >= 200 && this.status < 400) {
-                            var res = Ext.decode(this.response);
+                    if (pimcore.currentuser.admin) {
+                        request.onload = function () {
+                            if (this.status >= 200 && this.status < 400) {
+                                var res = Ext.decode(this.response);
 
-                            var request = new XMLHttpRequest();
-                            request.open('POST', "https://liveupdate.pimcore.org/statistics");
+                                var request = new XMLHttpRequest();
+                                request.open('POST', "https://liveupdate.pimcore.org/statistics");
 
-                            var data = new FormData();
-                            data.append('data', encodeURIComponent(JSON.stringify(res)));
+                                var data = new FormData();
+                                data.append('data', encodeURIComponent(JSON.stringify(res)));
 
-                            request.send(data);
-                        }
-                    };
+                                request.send(data);
+                            }
+                        };
+                    }
                     request.send(data);
                 }
             }

@@ -18,6 +18,7 @@
 
 use Doctrine\DBAL\Connection;
 use Exception;
+use GuzzleHttp\ClientInterface;
 use Pimcore\Bundle\AdminBundle\Controller\AdminAbstractController;
 use Pimcore\Bundle\AdminBundle\Event\AdminEvents;
 use Pimcore\Bundle\AdminBundle\Event\IndexActionSettingsEvent;
@@ -61,7 +62,8 @@ class IndexController extends AdminAbstractController implements KernelResponseE
 {
     public function __construct(
         protected EventDispatcherInterface $eventDispatcher,
-        protected TranslatorInterface $translator
+        protected TranslatorInterface $translator,
+        protected ClientInterface $httpClient
     ) {
     }
 
@@ -156,7 +158,21 @@ public function statisticsAction(Request $request, Connection $db, KernelInterfa
             $data = [];
         }
 
-        return $this->adminJson($data);
+        if ($this->getAdminUser()->isAdmin()) {
+            return $this->adminJson($data);
+        }
+
+        $response = $this->httpClient->request(
+            'POST',
+            'https://liveupdate.pimcore.org/statistics',
+            [
+                'body' => json_encode($data),
+            ]
+        );
+
+        return $this->adminJson([
+            'success' => ($response->getStatusCode() >= 200 && $response->getStatusCode() < 400),
+        ]);
     }
 
     protected function addRuntimePerspective(array &$templateParams, User $user): static