---
id: "CVE-2026-111665"
kind: "vulnerability"
aliases: ["CVE-2026-111665"]
title: "Piranha CMS: any manager user can change site languages without permission"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dotnet", "package", "piranha-cms", "self-hosted"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-10-16T18:17:48+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:18:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111665", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Piranha CMS: any manager user can change site languages without permission

Piranha CMS through 12.2 does not check granular permissions on its language management API, so any authenticated manager user can list, create, edit and delete site languages. An attacker with a low-privilege manager account can remove languages and reassign sites to the default language, altering localized content across the instance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Piranha version with `dotnet list package` and confirm whether it is `12.2` or earlier.
- Review which manager accounts exist and whether any hold rights without the Language, LanguageAdd, LanguageEdit or LanguageDelete permissions.

## Fix

- Upgrade Piranha CMS to a release after `12.2`; the sources do not name the fixed version, so check the project's release notes.
- Until patched, restrict manager accounts to trusted editors.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111665

## From the sources

Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_