CVE-2026-119649 in Orchard
Summary
by MITRE • 10/30/2026
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The identified security flaw resides within the Orchard CMS platform, specifically affecting versions 1.10.3 through 1.11, and centers on a critical failure in access control mechanisms implemented within the MediaLibraryService component. The vulnerability is classified as an improper authorization issue, technically corresponding to CWE-284: Improper Access Control. This defect manifests primarily in the CheckMediaFolderPermission method, which serves as the gatekeeper for media-related operations but fails to adequately validate whether the requesting user possesses sufficient privileges relative to the specific resource being accessed. Consequently, users with lower-level roles such as Authors and Contributors are able to bypass intended restrictions that should limit their scope of operation to only those assets they have explicitly created or been granted permission to manage.
From an operational perspective, this authorization bypass allows malicious actors who have obtained valid authentication credentials for these standard user roles to interact with media files belonging to other users within the same tenant environment. The attacker can leverage content identifiers to retrieve and display private media items that were not intended for public consumption or cross-user visibility. Furthermore, the vulnerability extends beyond mere viewing; it permits the cloning of existing media assets, effectively duplicating proprietary or sensitive data without authorization. This capability significantly amplifies the risk profile by enabling data exfiltration through duplication rather than direct download, potentially evading certain logging mechanisms that might track file access but not creation events.
The impact is further exacerbated by the ability to delete arbitrary media folders via the FolderController.Delete endpoint. While this action requires specific folder identifiers, the underlying authorization logic does not strictly enforce ownership or administrative rights before executing deletion commands. This leads to CWE-611: Improper Restriction of XML External Entity References in a broader sense of improper restriction of resource access, though more accurately it represents a breakdown in object-level security controls. The ability to delete folders results in data loss and potential denial of service for other users whose content is inadvertently or maliciously removed from the system. This disrupts business continuity and compromises the integrity of stored digital assets, which may include confidential documents, images, or multimedia files essential to organizational operations.
In terms of threat modeling, this vulnerability aligns with MITRE ATT&CK techniques related to Collection via Command and Scripting Interpreter if script-based exfiltration is used, but more directly maps to T1005: Data from Local System Access where an attacker retrieves data from local storage without proper authorization. It also reflects aspects of privilege escalation in a horizontal sense, as the user escalates their effective permissions beyond what their role dictates, moving from content creation to full management and destruction of others' assets. This is particularly dangerous in multi-tenant SaaS deployments or shared hosting environments where strict isolation between users is paramount for data privacy compliance.
To mitigate this vulnerability, immediate action should be taken by upgrading the Orchard CMS installation to a version that includes patches addressing these authorization checks. Administrators must ensure that all instances running versions 1.10.3 through 1.11 are updated to the latest stable release where the CheckMediaFolderPermission logic has been hardened. In environments where immediate patching is not feasible, network-level controls such as Web Application Firewalls can be configured to monitor and restrict unusual patterns of media access or deletion requests originating from low-privilege accounts. Additionally, implementing strict logging and monitoring for folder deletion events by non-administrative users can aid in early detection of exploitation attempts. Regular audits of user roles and permissions should also be conducted to ensure that the principle of least privilege is strictly enforced across all content management operations.