Orchard CMS versions 1.10.3 through 1.11 contain an improper authorization flaw in MediaLibraryService.CheckMediaFolderPermission that allows authenticated users with Author or Contributor roles to read, clone, and delete media items belonging to other users. The vulnerability originates from inadequate permission checks on media folders, enabling the attacker to view or manipulate any media item by its content identifier and to delete entire media folders via the FolderController.Delete endpoint. This results in a violation of confidentiality and integrity of user‑generated content and can be used to obscure evidence or disrupt business operations.

The flaw affects Orchard CMS, specifically releases 1.10.3 to 1.11. Administrators deploying these versions should verify their installation and compare against the affected version list found in the advisory.

The CVSS score of 7.1 indicates a moderately high risk, and the vulnerability is exploitable by any authenticated user with standard author or contributor privileges. The EPSS score is not available, so the probability of exploitation cannot be quantified from the public data. The issue is not listed in the CISA KEV catalog. Attackers would need to authenticate to the CMS and then enumerate media items via known content identifiers to harvest or delete media. The lack of a publicly published exploit does not mitigate the need for timely remediation.