Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111665Piranha CMS through 12.2 Missing Authorization in Manager Language API

Medium 5.4

In plain English

A medium-severity missing authorization in Piranha CMS from PiranhaCMS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 72.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.

Affected products (as reported)

Vendor	Product	Versions
PiranhaCMS	Piranha CMS	0 – through 12.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

https://hackmd.io/@hieuPenguinnn/piranha-cms-manager-language-api-missing-permission third-party-advisory
https://github.com/PiranhaCMS/piranha.core/blob/v12.2/core/Piranha.Manager/Controllers/LanguageApiController.cs#L21-L89 technical-description
https://github.com/PiranhaCMS/piranha.core/blob/v12.2/core/Piranha.Manager/Services/LanguageService.cs#L84-L110 technical-description
VulnCheck Advisory: Piranha CMS through 12.2 Missing Authorization in Manager Language API third-party-advisory