Orchard CMS versions 1.10.3 through 1.11 have an improper authorization vulnerability in the MediaLibraryService.CheckMediaFolderPermission() function. This flaw allows authenticated users with Author or Contributor roles to access media items belonging to other users. Exploitation enables attackers to display, clone, and delete other users' media by content ID and to delete arbitrary media folders via FolderController.Delete().