Piranha CMS through 12.2 Missing Authorization in Manager Language API
Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.
CVE-2026-111665
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-111665
Piranha CMS
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://github.com/PiranhaCMS/piranha.core",
"vendor": "PiranhaCMS",
"product": "Piranha CMS",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "custom",
"lessThanOrEqual": "12.2"
}
],
"packageURL": "pkg:github/PiranhaCMS/piranha.core",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-111665
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #38846 · Revision 1
- Added to Heist Feed
- Publisher date