Improper Authorization in Orchard CMS Media Library Affects User Media Access

CVE-2026-119649

What is CVE-2026-119649?

The Orchard CMS versions 1.10.3 through 1.11 are vulnerable to an improper authorization flaw within the MediaLibraryService.CheckMediaFolderPermission() function. This vulnerability enables authenticated users, such as Authors and Contributors, to gain unauthorized access to other users' media files. Malicious actors can exploit this to display, copy, or delete media items belonging to other users by manipulating content IDs. They can also delete arbitrary media folders through the FolderController.Delete() method, potentially leading to significant data loss and privacy breaches.

References