Live › vulnerability › CVE-2026-111665
Go to dashboardPiranha CMS through 12.2 does not check granular permissions on its language management API, so any authenticated manager user can list, create, edit and delete site languages. An attacker with a low-privilege manager account can remove languages and reassign sites to the default language, altering localized content across the instance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Piranha CMS 12.2 or earlier that have manager users who are not fully trusted with site-wide settings. The exposure is through the authenticated manager API, so anonymous visitors cannot trigger it. Sites where every manager is an administrator with full rights gain little from the flaw.
No product ranges from the sources yet.
dotnet list package and confirm whether it is 12.2 or earlier.12.2; the sources do not name the fixed version, so check the project's release notes.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.
This page as .md · .json · in your agent: get_signal("CVE-2026-111665")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.