CVE-2026-111665

MEDIUM 5.4

Piranha CMS through 12.2 Missing Authorization in Manager Language API

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.

CWE	CWE-862
Vendor	piranhacms
Product	piranha cms
Published	Oct 16, 2026

Stay Ahead of the Next One

Get instant alerts for piranhacms piranha cms

Be the first to know when new medium vulnerabilities affecting piranhacms piranha cms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Affected Versions

PiranhaCMS / Piranha CMS

0 ≤ 12.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/piranha-cms-manager-language-api-missing-permission github.com: https://github.com/PiranhaCMS/piranha.core/blob/v12.2/core/Piranha.Manager/Controllers/LanguageApiController.cs#L21-L89 github.com: https://github.com/PiranhaCMS/piranha.core/blob/v12.2/core/Piranha.Manager/Services/LanguageService.cs#L84-L110 vulncheck.com: https://www.vulncheck.com/advisories/piranha-cms-through-12.2-missing-authorization-in-manager-language-api

Credits

hieuPenguinnn