CVE-2026-119649

CVSS 7.1 (high) · published 2026-10-30

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().

Weakness: CWE-863

Source: NVD CVE-2026-119649

References

• https://github.com/OrchardCMS/Orchard
• https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/IMediaLibraryService.cs#L169-L177
• https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/MediaLibraryService.cs#L281-L302
• https://github.com/OrchardCMS/Orchard/issues/8895
• https://hackmd.io/@hieuPenguinnn/orchard-media-library-cross-user-broken-access-control
• https://www.vulncheck.com/advisories/orchard-cms-1.10.3-through-1.11-improper-authorization-via-media-library-folder-permission-check

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.