CVE-2026-119649

HighCVSS 7.1/10Last modified Oct 30, 2026

Description

Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete().

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
OrchardCMS	Orchard	>= 1.10.3, <= 1.11

References

Timeline

Published: Oct 30, 2026
Last modified: Oct 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-119656.5The User Registration & Membership WordPress plugin before 5.2.0 does not enforce payment completion before activating a paid membership su CVE-2026-1196505.4HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to CVE-2026-1196515.4HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated use CVE-2026-1196524.3HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticate CVE-2026-1196534.3Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by CVE-2026-1196548.8DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling CVE-2026-1196557.5CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated CVE-2026-1196567.5CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via t CVE-2026-1196575.0FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage othe CVE-2026-1196584.3PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh seco CVE-2026-1196595.4Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because CVE-2026-119665.3The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability check for unauthenticated callers on one of