CVE-2026-119649
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().
Risk Assessment
Low-privileged authenticated users can access and delete other users' private media files, compromising the confidentiality and integrity of organizational content.
Recommendation
Upgrade Orchard CMS to a version containing the authorization fix in MediaLibraryService and FolderController. Until then, restrict Author and Contributor roles and monitor for unusual media operations.
Other vulnerabilities in Orchard CMS
Original NVD description (English source)
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().
Vulnerability data from NVD (NIST) · CISA KEV · EPSS