OrchardCMS/OrchardCore · error · InvalidOperationException

Not authorized to upload media.

Error message

Not authorized to upload media.

What it means

Before writing the uploaded file, the handler authorizes the user against MediaPermissions.ManageMedia and MediaPermissions.ManageMediaFolder for the target directory. If either authorization fails it throws 'Not authorized to upload media.'.

Solutions

1. Grant the user's role the 'Manage Media' permission in Admin > Security > Roles
2. Grant folder-level ManageMediaFolder permission for the target directory, or upload to a permitted folder
3. Verify with a test login that the same user can upload via the Media admin UI

var canManage = await authorizationService.AuthorizeAsync(user, MediaPermissions.ManageMedia); var canManageFolder = await authorizationService.AuthorizeAsync(user, MediaPermissions.ManageMediaFolder, directoryName);

try { await client.NewMediaObjectAsync(blogId, user, pass, media); } catch (InvalidOperationException ex) when (ex.Message == "Not authorized to upload media.") { throw new UnauthorizedAccessException("Grant the user ManageMedia and folder permissions", ex); }

When it happens

Trigger: metaWeblog.newMediaObject invoked by an authenticated user whose role lacks ManageMedia permission, or who cannot manage the specific target media folder.

Common situations: Blog author accounts without media permissions; uploads targeting a subfolder the role is not allowed to manage (folder-scoped permission); newly created roles missing media feature permissions.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• The media path is invalid.
• This file extension is not allowed
• returned a null .
• Error creating directory
• Error deleting file

AI-assisted analysis of OrchardCMS/OrchardCore@4306c0717f (2026-09-13). Data as JSON: /api/errors/2da5ef4278520ef7. Report an issue: GitHub.

Appendix: source

Thrown at src/OrchardCore.Modules/OrchardCore.Lists/RemotePublishing/MetaWeblogHandler.cs:180

        if (string.IsNullOrWhiteSpace(normalizedPath))
        {
            throw new InvalidOperationException(S["The media path is invalid."].Value);
        }

        var pathSegments = normalizedPath.Split('/', StringSplitOptions.RemoveEmptyEntries);
        if (pathSegments.Any(segment => segment is "." or ".."))
        {
            throw new InvalidOperationException(S["The media path is invalid."].Value);
        }

        var fileName = pathSegments[^1];
        var directoryName = string.Join('/', pathSegments[..^1]);
        var filePath = _mediaFileStore.Combine(directoryName, fileName);

        if (!await _authorizationService.AuthorizeAsync(user, MediaPermissions.ManageMedia)
            || !await _authorizationService.AuthorizeAsync(user, MediaPermissions.ManageMediaFolder, (object)(directoryName ?? string.Empty)))
        {
            throw new InvalidOperationException(S["Not authorized to upload media."].Value);
        }

        var extension = Path.GetExtension(filePath);
        var canUploadRestrictedMedia = await _authorizationService.AuthorizeAsync(
            user,
            MediaPermissions.UploadRestrictedMedia);
        if (!_mediaOptions.AllowedFileExtensions.Contains(extension)
            && (!canUploadRestrictedMedia
                || !_mediaOptions.RestrictedFileExtensions.Contains(extension)))
        {
            throw new InvalidOperationException(S["This file extension is not allowed: {0}", extension].Value);
        }

        Stream stream = null;
        try
        {
            stream = new MemoryStream(bits);
            filePath = await _mediaFileStore.CreateFileFromStreamAsync(

View on GitHub (pinned to 4306c0717f)