Permissions on media are inherited from the parent Security scope.

Typically, you need to have the Default permission to create media.