SZB-80f452855a
EUVD-2026-114065 reports authorization flaw in Orchard CMS media library
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Orchard CMS
- Product
- Orchard
- First seen
Summary
The EUVD entry, shared on Mastodon, says Orchard CMS 1.10.3 through 1.11 has an improper authorization flaw that lets authenticated Authors and Contributors access other users' media. It assigns a CVSS v3.1 score of 7.1 and says attackers can display, clone, and delete that media.
If you use Orchard CMS
Check the Orchard CMS project for a fixed release and upgrade beyond 1.11
Review Author and Contributor accounts and their media library access
Audit the media library for unexpected changes or deletions
What the sources say 1
· Mastodon: “Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media.” Source