From the issue you shared:

Thank you b4too - unless something new has been uncovered - which if so should be reported to us via our responsible disclosure policy - it is NOT possible to arbitrarily enumerate all media on a server without authentication, and saying as much is massive fear-mongering