{"id":"CVE-2026-119649","title":"Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check","summary":"Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, …","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","cvssSource":"cna","cwe":["CWE-863"],"vendor":"OrchardCMS","product":"Orchard","affected":["Orchard >= 1.10.3 <= 1.11"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-30T15:21:20.960556Z"},"published":"2026-10-30","updated":"2026-10-30","sourceUpdated":"2026-10-30T15:53:06.874Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119649","references":[{"url":"https://github.com/OrchardCMS/Orchard/issues/8895"},{"url":"https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/MediaLibraryService.cs#L281-L302"},{"url":"https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/IMediaLibraryService.cs#L169-L177"},{"url":"https://hackmd.io/@hieuPenguinnn/orchard-media-library-cross-user-broken-access-control"},{"url":"https://github.com/OrchardCMS/Orchard"},{"url":"https://www.vulncheck.com/advisories/orchard-cms-1.10.3-through-1.11-improper-authorization-via-media-library-folder-permission-check","label":"VulnCheck Advisory: Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check"}],"tags":["cve.org"],"epss":0.00363,"epssPercentile":0.3032,"ingestedAt":"2026-11-05T16:07:30.510Z","slug":"CVE-2026-119649","body":"## Overview\n\nOrchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().\n\n## Affected\n\n- `Orchard >= 1.10.3 <= 1.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}