CVE-2026-111665: Piranha CMS through 12.2 Missing Authorization in Manager Language API

Q: Who can exploit this issue?

Any authenticated Piranha CMS manager user can exploit it, even if that user has not been granted the granular Language, LanguageAdd, LanguageEdit, or LanguageDelete permissions.

Q: What access and actions are required for exploitation?

An attacker needs authenticated manager access and can directly invoke the manager/api/language Get, Save, and Delete actions. No user interaction is required.

Q: What is the potential operational impact?

An attacker can list, create, modify, or delete site languages. Deleting languages can cause sites to be reassigned to the default language and affect localized content across the instance.

Q: Which versions are identified as affected?

The issue is reported in Piranha CMS through version 12.2.

Published Oct 16, 2026

Updated

Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.

Affected Software

1 affected component

Piranha CMS Piranha CMS<=12.2

Event History

Oct 16, 2026

CVE Published

via MITRE·05:39 PM

Data Sourced

via MITRE·05:39 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Any authenticated Piranha CMS manager user can exploit it, even if that user has not been granted the granular Language, LanguageAdd, LanguageEdit, or LanguageDelete permissions.

What access and actions are required for exploitation?

An attacker needs authenticated manager access and can directly invoke the manager/api/language Get, Save, and Delete actions. No user interaction is required.

What is the potential operational impact?

An attacker can list, create, modify, or delete site languages. Deleting languages can cause sites to be reassigned to the default language and affect localized content across the instance.

Which versions are identified as affected?

The issue is reported in Piranha CMS through version 12.2.

CVE-2026-111665: Piranha CMS through 12.2 Missing Authorization in Manager Language API

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access and actions are required for exploitation?

What is the potential operational impact?

Which versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access and actions are required for exploitation?

What is the potential operational impact?

Which versions are identified as affected?