CVE-2026-119649

HIGH 7.1

Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().

CWE	CWE-863
Vendor	orchardcms
Product	orchard
Published	Oct 30, 2026
Last Updated	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for orchardcms orchard

Be the first to know when new high vulnerabilities affecting orchardcms orchard are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Affected Versions

OrchardCMS / Orchard

1.10.3 ≤ 1.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/OrchardCMS/Orchard/issues/8895 github.com: https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/MediaLibraryService.cs#L281-L302 github.com: https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/IMediaLibraryService.cs#L169-L177 hackmd.io: https://hackmd.io/@hieuPenguinnn/orchard-media-library-cross-user-broken-access-control github.com: https://github.com/OrchardCMS/Orchard vulncheck.com: https://www.vulncheck.com/advisories/orchard-cms-1.10.3-through-1.11-improper-authorization-via-media-library-folder-permission-check

Credits

hieuPenguinnn