Orchard CMS CVE-2026-119649

Exploitation requires the attacker to already hold an authenticated Orchard CMS account with the Author or Contributor role (PR:L) and to use the Orchard.MediaLibrary module; the attacker then references another user's media by content id for the display/clone/delete operations or calls FolderController.Delete() for folder deletion. The root cause is that MediaLibraryService.CheckMediaFolderPermission() omits an owner/ownership check, so no special or non-default configuration is needed beyond having a multi-user site with these roles provisioned. The principal limiting factor is the required low-privilege authenticated role - the flaw cannot be triggered by anonymous or unauthenticated visitors - which confines realistic risk to installations that grant Author/Contributor accounts to semi-trusted users.

The CVSS 4.0 score of 7.1 (High) reflects a network-reachable flaw (AV:N) with low complexity (AC:L) and no attack requirements (AT:N), but crucially PR:L means a valid authenticated account carrying the Author or Contributor role is required - this is not a remote-unauthenticated issue. Impact is weighted toward integrity (VI:H, from deleting other users' media items and arbitrary media folders) with limited confidentiality exposure (VC:L, from viewing/cloning others' media) and no availability or subsequent-system impact (VA:N/SC:N/SI:N/SA:N). No EPSS score and no KEV status were provided in the input, so there is no quantitative exploitation-probability or active-exploitation signal; the vuln.today Decision label is 'this_week' rather than act_now or emergency, consistent with a serious but non-crisis bug. The multi-source picture is coherent: VulnCheck authored an advisory, a public technical write-up (hackmd) and an open upstream issue exist, but no evidence of active exploitation. Net assessment: a genuine broken-access-control defect that is a real priority for multi-author Orchard deployments, yet its need for a pre-existing low-privilege account and its limited blast radius (confined to media/folder data) make it materially lower risk than a pre-auth RCE despite the High score.

A low-privilege user holding the Author or Contributor role in an Orchard CMS install (or an attacker who has compromised such an account) references another user's media items by their content id and invokes the Media Library display, clone, or delete operations, then calls FolderController.Delete() to remove arbitrary media folders belonging to other users. Because CheckMediaFolderPermission() does not enforce per-owner ownership, these cross-user operations succeed. A public PoC reference exists (a hackmd write-up and an upstream GitHub issue); it is not verified as working exploit code.