CVE-2026-119649: Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().
Event History
Frequently Asked Questions
Which users can exploit this issue?
Authenticated users assigned the Author or Contributor role can exploit the vulnerable authorization checks. No unauthenticated access or user interaction is required.
What actions can an attacker perform?
An attacker can access media belonging to other users by content ID, including displaying, cloning, and deleting media items. They can also delete arbitrary media folders through FolderController.Delete().
Which Orchard CMS versions are affected?
The affected range is Orchard CMS 1.10.3 through 1.11.