CVE-2026-119649— Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check

Quick assessment

Affected

OrchardCMS Orchard

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Orchard CMS 1.10.3 至 1.11 版本在方法中存在一个授权不当漏洞。该漏洞允许已认证的“作者（Authors）”和“贡献者（Contributors）”访问其他用户的媒体资源。攻击者可以通过内容 ID 查看、克隆和删除其他用户的媒体项，并可通过方法删除任意媒体文件夹。

CVSS 7.1 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1083 · File and Directory Discovery T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check

Source: CVE Program / CVE List V5

Vulnerability Description

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不正确

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
OrchardCMS	Orchard	1.10.3 ~ 1.11	-

II. Public POCs for CVE-2026-119649

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119649

请登录查看更多情报信息。

Other References for CVE-2026-119649 (6)

https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/IMediaLibraryService.cs#L169-L177 technical-description
https://github.com/OrchardCMS/Orchard product
https://hackmd.io/@hieuPenguinnn/orchard-media-library-cross-user-broken-access-control third-party-advisory
https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/MediaLibraryService.cs#L281-L302 technical-description
https://github.com/OrchardCMS/Orchard/issues/8895 issue-tracking
https://www.vulncheck.com/advisories/orchard-cms-1.10.3-through-1.11-improper-authorization-via-media-library-folder-permission-check third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119649

IV. Related Vulnerabilities

Same vendor: OrchardCMS

Same weakness: CWE-863