Orchard CMS media library lets authors access other users' media
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
Orchard CMS from 1.10.3 through 1.11 has an improper authorization flaw in MediaLibraryService.CheckMediaFolderPermission() (CWE-863). An authenticated user with the Author or Contributor role can access other users' media, including displaying, cloning and deleting their media items by content id, and can delete arbitrary media folders through FolderController.Delete(). The CVSS 4.0 base score is 7.1 (HIGH).
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| orchardcms | Orchard | 1.10.3 – 1.11 | — | No fix listed | CNA |
- Orchard Vendororchardcms Affected 1.10.3 – 1.11 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for Orchard.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Timeline
- 2026-10-30 Threatist record created from CVE-2026-119649
- 2026-10-30 CISA SSVC decision points changed
- 2026-10-30 Priority changed: MEDIUM → LOW
- 2026-10-30 Alias added: GHSA-wppp-cf83-wqwx
References
Other 4
- https://github.com/OrchardCMS/Orchard/issues/8895
- https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/MediaLibraryService.cs#L281-L302
- https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/IMediaLibraryService.cs#L169-L177
- https://github.com/OrchardCMS/Orchard
More orchardcms vulnerabilities
- TI-2021-07972 Orchard Core CMS - Improper Session Termination after Password Change CVSS 3.1HIGH 8.8
- TI-2020-19154 Orchard Core RC1 - Persistent Cross-Site Scripting CVSS 4.0MEDIUM 5.1
- TI-2022-17540 Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). CVSS 3.1CRITICAL 9.0
- TI-2022-00728 Improper Authorization in orchardcms/orchardcore CVSS 3.1MEDIUM 6.5
- TI-2022-00727 Cross-site Scripting (XSS) - Stored in orchardcms/orchardcore CVSS 3.1MEDIUM 6.1
- TI-2022-13899 OrchardCore - HTML Injection CVSS 3.1MEDIUM 5.4
Sources
- CVE-2026-119649 · CVE Program
- CVE-2026-119649 · NVD
- FIRST EPSS
- GHSA-wppp-cf83-wqwx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences