CVE-2026-119649 Details

A vulnerability exists in Orchard CMS versions 1.10.3 through 1.11, specifically within the Media Library module. The issue arises from an improper authorization check in the 'MediaLibraryService.CheckMediaFolderPermission()' method. This flaw allows authenticated users with the Author or Contributor role, who typically have the 'ManageOwnMedia' permission, to access and manipulate media belonging to other users. Exploitation of this vulnerability enables an attacker to view, clone, and delete media items from other users, as well as delete entire media folders through the 'FolderController.Delete()' method.

The authorization check in 'MediaLibraryService.CheckMediaFolderPermission()' should be modified to compare the requested folder path to the user's own folder without adding a prefix. This comparison should be anchored with a trailing directory separator to prevent prefix-based matches. Additionally, the 'CanManageMediaFolder' method should be updated to use the same anchored comparison. Longer-term, the per-user media folder structure should be based on the immutable user ID instead of the mutable username, and the media ownership should be managed through a direct ID comparison.