{"id":"CVE-2026-111665","kind":"vulnerability","aliases":["CVE-2026-111665"],"related":[],"title":"Piranha CMS: any manager user can change site languages without permission","description":"Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.","summary":"Piranha CMS through 12.2 does not check granular permissions on its language management API, so any authenticated manager user can list, create, edit and delete site languages. An attacker with a low-privilege manager account can remove languages and reassign sites to the default language, altering localized content across the instance.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dotnet","package","piranha-cms","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed Piranha version with `dotnet list package` and confirm whether it is `12.2` or earlier.\n- Review which manager accounts exist and whether any hold rights without the Language, LanguageAdd, LanguageEdit or LanguageDelete permissions.","fix":"- Upgrade Piranha CMS to a release after `12.2`; the sources do not name the fixed version, so check the project's release notes.\n- Until patched, restrict manager accounts to trusted editors.","status":"open","published_at":"2026-10-16T18:17:48+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:18:21+00:00","updated_at":"2026-10-25T04:18:21+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:18:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Piranha CMS to a release after `12.2`; the sources do not name the fixed version, so check the project's release notes.\n- Until patched, restrict manager accounts to trusted editors.","reach":"internet","title":"Piranha CMS: any manager user can change site languages without permission","impact":"medium","summary":"Piranha CMS through 12.2 does not check granular permissions on its language management API, so any authenticated manager user can list, create, edit and delete site languages. An attacker with a low-privilege manager account can remove languages and reassign sites to the default language, altering localized content across the instance.","category":"package","nicknames":[],"who_cares":["piranha-cms","dotnet","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated manager removes site languages and reassigns sites, altering localized content","analyst_note":"Confirm the fixed Piranha version and the upstream advisory; the sources do not give a patched release.","how_to_check":"- Check the installed Piranha version with `dotnet list package` and confirm whether it is `12.2` or earlier.\n- Review which manager accounts exist and whether any hold rights without the Language, LanguageAdd, LanguageEdit or LanguageDelete permissions.","needs_analyst":true,"not_affected_if":["auth-required","default-config"],"who_is_affected":"Sites running Piranha CMS 12.2 or earlier that have manager users who are not fully trusted with site-wide settings. The exposure is through the authenticated manager API, so anonymous visitors cannot trigger it. Sites where every manager is an administrator with full rights gain little from the flaw.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000641,"input_tokens":3378,"output_tokens":607,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111665':14A,17A '-2026':13A,16A '12.2':29B,81C 'account':61B 'across':75B 'action':123C 'affect':134C 'allow':92C 'alter':72B 'api':39B 'attack':54B,114C 'authent':42B,94C 'author':85C 'call':116C 'chang':7A 'check':32B 'cms':2A,22B,27B,79C 'contain':82C 'content':74B,136C 'creat':47B,99C 'cve':12A,15A 'default':70B,133C 'delet':50B,102C,122C 'direct':124C 'dotnet':18B 'edit':48B,100C 'get':119C 'granular':33B,107C 'host':25B 'instanc':77B,138C 'instance-wid':137C 'languag':9A,37B,52B,64B,71B,104C,108C,127C 'languageadd':109C 'languageapicontrol':90C 'languagedelet':112C 'languageedit':110C 'list':46B,98C 'local':73B,135C 'low':58B 'low-privileg':57B 'manag':4A,38B,43B,60B,95C 'manager/api/language':118C 'miss':84C 'packag':19B 'permiss':11A,34B,113C 'piranha':1A,21B,26B,78C 'piranha-cm':20B 'piranha.manager':89C 'privileg':59B 'reassign':66B,129C 'remov':63B,126C 'save':120C 'self':24B 'self-host':23B 'site':8A,51B,67B,103C,130C 'user':5A,44B,96C 'vulner':86C 'wide':139C 'without':10A,105C","nicknames":[],"mitigations":[],"who_affected":"Sites running Piranha CMS 12.2 or earlier that have manager users who are not fully trusted with site-wide settings. The exposure is through the authenticated manager API, so anonymous visitors cannot trigger it. Sites where every manager is an administrator with full rights gain little from the flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T18:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111665","severity":null,"published_at":"2026-10-16T18:17:48+00:00","modified_at":"2026-10-19T14:16:58+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}