NVD security advisoryHigh
High advisory for Orchard CMS 1.10.3
CVE-2026-119649 · Reported 30 Oct 2026
Full advisory details, affected packages, severity context, and original source.
Affected technology
Orchard CMS 1.10.3Affected product
Advisory overview
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().
Related references
- https://github.com/OrchardCMS/Orchard
- https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/IMediaLibraryService.cs#L169-L177
- https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/MediaLibraryService.cs#L281-L302
- https://github.com/OrchardCMS/Orchard/issues/8895
- https://hackmd.io/@hieuPenguinnn/orchard-media-library-cross-user-broken-access-control
- https://www.vulncheck.com/advisories/orchard-cms-1.10.3-through-1.11-improper-authorization-via-media-library-folder-permission-check