{"id":"CVE-2026-119649","kind":"vulnerability","aliases":["CVE-2026-119649"],"related":[],"title":"Orchard CMS: authors can read, copy and delete other users' media","description":"Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().","summary":"Orchard CMS (classic, 1.10.3 through 1.11) lets a logged-in Author or Contributor read, clone and delete other users' media items by numeric id, and delete other users' media folders. CheckMediaFolderPermission() always passes for users holding only ManageOwnMedia. No fixed release is known yet.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Orchard CMS","fixed":[],"affected":">= 1.10.3, <= 1.11","ecosystem":"nuget"}],"ecosystems":[],"tags":["asp.net","media-library","orchard-cms","runtime","self-hosted"],"not_affected_if":["media-library-disabled","no-author-or-contributor-roles","orchard-core","single-user-site"],"how_to_check":"- Find the Orchard version: check the Orchard.Web/Orchard.Core version in your build or the admin dashboard; versions 1.10.3 through 1.11 are affected (1.11 is the latest release).\n- Check that the Orchard.MediaLibrary module is enabled (Admin > Modules/Features).\n- In Admin > Users > Roles, see which accounts have the Author or Contributor role, or any role with ManageOwnMedia but not ManageMediaContent. If you do not trust all of them, you are exposed.","fix":null,"status":"open","published_at":"2026-10-30T15:16:48+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","triaged_at":"2026-10-30T15:33:26+00:00","updated_at":"2026-10-30T15:34:55+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-30T15:33:26Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Orchard CMS: authors can read, copy and delete other users' media","impact":"medium","summary":"Orchard CMS 1.10.3 through 1.11 fails to check media folder permissions in MediaLibraryService.CheckMediaFolderPermission(). A logged-in Author or Contributor can display, clone and delete other users' media items by content id, and delete arbitrary media folders.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["orchard-cms","asp.net","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated editors delete other users' media and folders","analyst_note":"Find the fixed Orchard CMS version and the advisory text at https://nvd.nist.gov/vuln/detail/CVE-2026-119649 and the Orchard project's release notes.","how_to_check":"- Look at the Orchard.Core package version in the site's project file or `packages.config`\n- Confirm whether the site runs a version from `1.10.3` through `1.11`\n- Check whether any untrusted users hold the Author or Contributor role","plain_action":"","needs_analyst":true,"not_affected_if":["single-user-site","no-author-or-contributor-roles"],"who_is_affected":"Sites running Orchard CMS 1.10.3 through 1.11 that have multiple users with Author or Contributor roles, since those roles are the ones that can reach other users' media. Single-author sites or sites where all editors are fully trusted have a much smaller exposure. The sources do not say which configurations beyond this are required.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000716,"input_tokens":4142,"output_tokens":603,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed Orchard CMS version and the advisory text at https://nvd.nist.gov/vuln/detail/CVE-2026-119649 and the Orchard project's release notes.","search":"'-119649':14A,17A '-2026':13A,16A '1.10.3':34B,78C '1.11':36B,80C 'access':95C 'allow':89C 'alway':63B 'arbitrari':114C 'asp.net':20B 'attack':99C 'authent':90C 'author':3A,42B,84C,91C 'checkmediafolderpermiss':62B 'classic':33B 'clone':46B,102C 'cms':2A,19A,26B,32B,77C 'contain':81C 'content':110C 'contributor':44B,93C 'copi':6A 'cve':12A,15A 'delet':8A,48B,57B,104C,113C 'display':101C 'fix':71B 'folder':61B,116C 'foldercontroller.delete':118C 'hold':67B 'host':30B 'id':55B,111C 'improp':83C 'item':52B,108C 'known':74B 'let':37B 'librari':23B 'log':40B 'logged-in':39B 'manageownmedia':69B 'media':11A,22B,51B,60B,98C,107C,115C 'media-librari':21B 'medialibraryservice.checkmediafolderpermission':87C 'numer':54B 'orchard':1A,18A,25B,31B,76C 'orchard-cm':24B 'pass':64B 'read':5A,45B 'releas':72B 'runtim':27B 'self':29B 'self-host':28B 'user':10A,50B,59B,66B,97C,106C 'via':117C 'vulner':85C 'yet':75B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted classic Orchard CMS (not Orchard Core) sites on 1.10.3 through 1.11 with the Media Library module enabled and more than one user holding Author, Contributor, or another role with only ManageOwnMedia. Those users can reach other users' media by content id and delete other users' media folders. Sites where every such user is fully trusted, or that have a single editor, can mostly skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119649","severity":null,"published_at":"2026-10-30T15:16:48+00:00","modified_at":"2026-10-30T15:16:48+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","fetched_at":"2026-10-30T15:31:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119649:1168","url":null,"severity":null,"published_at":"2026-10-30T15:34:55+00:00","modified_at":"2026-10-30T15:34:55+00:00","first_seen_at":"2026-10-30T15:34:55+00:00","fetched_at":"2026-10-30T15:34:55+00:00","note":"No fixed version found: Orchard releases page lists 1.11 (Jan) as latest, and the affected range runs to 1.11. The upstream issue #8895 did not load, so no maintainer statement was read. The VulnCheck advisory and the reporter's write-up (hackmd) were read; neither is a vendor page, so nothing is marked verified. The root cause is in the reporter's write-up: GetRootedFolderPath prepends the caller's own root, so the StartsWith check in CheckMediaFolderPermission is always true. Affects any user with ManageOwnMedia only, which is the default for Author and Contributor. Reachable in a default install with Media Library enabled. Not exploited and no PoC found. Reporter's request steps are illustrative and were not run."}],"documents":[{"id":24326,"url":"https://www.vulncheck.com/advisories/orchard-cms-1.10.3-through-1.11-improper-authorization-via-media-library-folder-permission-check","title":"VulnCheck: Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":24328,"url":"https://hackmd.io/@hieuPenguinnn/orchard-media-library-cross-user-broken-access-control","title":"Orchard CMS Media Library: ManageOwnMedia users can read, delete, and clone any other user's media (reporter write-up)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":24330,"url":"https://github.com/OrchardCMS/Orchard/releases","title":"Orchard releases (latest 1.11)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}