Live › vulnerability › CVE-2026-119649
Orchard CMS (classic, 1.10.3 through 1.11) lets a logged-in Author or Contributor read, clone and delete other users' media items by numeric id, and delete other users' media folders. CheckMediaFolderPermission() always passes for users holding only ManageOwnMedia. No fixed release is known yet.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Self-hosted classic Orchard CMS (not Orchard Core) sites on 1.10.3 through 1.11 with the Media Library module enabled and more than one user holding Author, Contributor, or another role with only ManageOwnMedia. Those users can reach other users' media by content id and delete other users' media folders. Sites where every such user is fully trusted, or that have a single editor, can mostly skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Orchard CMS | nuget | >= 1.10.3, <= 1.11 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().
This page as .md · .json · in your agent: get_signal("CVE-2026-119649")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.