Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck
CVE-2026-119649Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check
High 7.1
In plain English
A high-severity incorrect authorization in Orchard from OrchardCMS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.4%top 69.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| OrchardCMS | Orchard | 1.10.3 – through 1.11 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
References
- https://github.com/OrchardCMS/Orchard/issues/8895 issue-tracking
- https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/MediaLibraryService.cs#L281-L302 technical-description
- https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/IMediaLibraryService.cs#L169-L177 technical-description
- https://hackmd.io/@hieuPenguinnn/orchard-media-library-cross-user-broken-access-control third-party-advisory
- https://github.com/OrchardCMS/Orchard product
- VulnCheck Advisory: Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check third-party-advisory