Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 7.1 · orchardcmsNVD modified 2026-10-30 14:16
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 6
- https://github.com/OrchardCMS/Orchard/issues/8895 issue-tracking
- https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/MediaLibraryService.cs#L281-L302 technical-description
- https://github.com/OrchardCMS/Orchard/blob/1.11/src/Orchard.Web/Modules/Orchard.MediaLibrary/Services/IMediaLibraryService.cs#L169-L177 technical-description
- https://hackmd.io/@hieuPenguinnn/orchard-media-library-cross-user-broken-access-control third-party-advisory
- https://github.com/OrchardCMS/Orchard product
- https://www.vulncheck.com/advisories/orchard-cms-1.10.3-through-1.11-improper-authorization-via-media-library-folder-permission-check third-party-advisory