---
id: "CVE-2026-119649"
kind: "vulnerability"
aliases: ["CVE-2026-119649"]
title: "Orchard CMS: authors can read, copy and delete other users' media"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Orchard CMS", "fixed": [], "affected": ">= 1.10.3, <= 1.11", "ecosystem": "nuget"}]
ecosystems: []
tags: ["asp.net", "media-library", "orchard-cms", "runtime", "self-hosted"]
not_affected_if: ["media-library-disabled", "no-author-or-contributor-roles", "orchard-core", "single-user-site"]
published_at: "2026-10-30T15:16:48+00:00"
first_seen_at: "2026-10-30T15:31:10+00:00"
updated_at: "2026-10-30T15:34:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119649", "first_seen_at": "2026-10-30T15:31:10+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T15:34:55+00:00"}]
---

# Orchard CMS: authors can read, copy and delete other users' media

Orchard CMS (classic, 1.10.3 through 1.11) lets a logged-in Author or Contributor read, clone and delete other users' media items by numeric id, and delete other users' media folders. CheckMediaFolderPermission() always passes for users holding only ManageOwnMedia. No fixed release is known yet.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- nuget:Orchard CMS affected >= 1.10.3, <= 1.11 fixed ?

## How to check

- Find the Orchard version: check the Orchard.Web/Orchard.Core version in your build or the admin dashboard; versions 1.10.3 through 1.11 are affected (1.11 is the latest release).
- Check that the Orchard.MediaLibrary module is enabled (Admin > Modules/Features).
- In Admin > Users > Roles, see which accounts have the Author or Contributor role, or any role with ManageOwnMedia but not ManageMediaContent. If you do not trust all of them, you are exposed.

## Timeline

- 2026-10-30T15:31:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119649
- 2026-10-30T15:34:55+00:00 analyst — No fixed version found: Orchard releases page lists 1.11 (Jan) as latest, and the affected range runs to 1.11. The upstream issue #8895 did not load, so no maintainer statement was read. The VulnCheck advisory and the reporter's write-up (hackmd) were read; neither is a vendor page, so nothing is marked verified. The root cause is in the reporter's write-up: GetRootedFolderPath prepends the caller's own root, so the StartsWith check in CheckMediaFolderPermission is always true. Affects any user with ManageOwnMedia only, which is the default for Author and Contributor. Reachable in a default install with Media Library enabled. Not exploited and no PoC found. Reporter's request steps are illustrative and were not run.

## Documents

- [advisory] VulnCheck: Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check https://www.vulncheck.com/advisories/orchard-cms-1.10.3-through-1.11-improper-authorization-via-media-library-folder-permission-check
- [describes] Orchard CMS Media Library: ManageOwnMedia users can read, delete, and clone any other user's media (reporter write-up) https://hackmd.io/@hieuPenguinnn/orchard-media-library-cross-user-broken-access-control
- [mentions] Orchard releases (latest 1.11) https://github.com/OrchardCMS/Orchard/releases

## From the sources

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_