---
id: CVE-2026-119649
title: >-
  Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library
  Folder Permission Check
summary: >-
  Orchard CMS 1.10.3 through 1.11 contains an improper authorization
  vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows
  authenticated Authors and Contributors to access other users' media. Attackers
  can display, …
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: OrchardCMS
product: Orchard
affected:
  - Orchard >= 1.10.3 <= 1.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:21:20.960556Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:53:06.874Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119649'
references:
  - url: 'https://github.com/OrchardCMS/Orchard/issues/8895'
  - url: >-
      https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/MediaLibraryService.cs#L281-L302
  - url: >-
      https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/IMediaLibraryService.cs#L169-L177
  - url: >-
      https://hackmd.io/@hieuPenguinnn/orchard-media-library-cross-user-broken-access-control
  - url: 'https://github.com/OrchardCMS/Orchard'
  - url: >-
      https://www.vulncheck.com/advisories/orchard-cms-1.10.3-through-1.11-improper-authorization-via-media-library-folder-permission-check
    label: >-
      VulnCheck Advisory: Orchard CMS 1.10.3 through 1.11 Improper Authorization
      via Media Library Folder Permission Check
tags:
  - cve.org
epss: 0.00363
epssPercentile: 0.3032
ingestedAt: '2026-11-05T16:07:30.510Z'
---

## Overview

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().

## Affected

- `Orchard >= 1.10.3 <= 1.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.