CVE-2026-111665
Received Received - Intake

Piranha CMS Missing Authorization in Language Management

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: VulnCheck

Description
Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-111665
EUVD
EUVD-2026-102956

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
PiranhaCMS Piranha CMS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Piranha CMS through version 12.2 has a missing authorization vulnerability in the LanguageApiController. This flaw allows any authenticated manager user to perform unauthorized actions on site languages, such as listing, creating, editing, and deleting them, even without specific permissions like Language, LanguageAdd, LanguageEdit, or LanguageDelete.

Detection Guidance

To detect this vulnerability, check for unauthorized modifications to site languages in Piranha CMS. Review logs for suspicious API calls to manager/api/language with GET, POST, or DELETE methods. Ensure only authorized users have access to manager endpoints.

Impact Analysis

Attackers can exploit this vulnerability by directly calling the manager/api/language endpoints to remove languages and reassign sites to the default language. This can lead to unauthorized changes in localized content across the entire instance, potentially disrupting site functionality and content integrity.

Mitigation Strategies

Immediately update Piranha CMS to the latest version. Review and restrict permissions for manager users, ensuring only those with Language, LanguageAdd, LanguageEdit, or LanguageDelete permissions can access language-related functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111665. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart