CVE-2026-111665: Missing Authorization in PiranhaCMS Piranha CMS
Description
Piranha CMS versions up to 12.2 have a missing authorization vulnerability in the Piranha.Manager LanguageApiController. Authenticated manager users can perform language management actions without requiring specific granular permissions. This allows them to list, create, edit, and delete site languages, potentially impacting localized content across the site.
CVSS v4.0
Score 5.3medium
Affected software
PiranhaCMS
Piranha CMS
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-111665 describes a missing authorization vulnerability in Piranha CMS through version 12.2. The flaw exists in the LanguageApiController within the manager interface, where any authenticated manager user can invoke Get, Save, and Delete actions on site languages without needing the Language, LanguageAdd, LanguageEdit, or LanguageDelete permissions. This enables unauthorized modification or removal of languages and reassignment of sites to the default language, affecting localized content instance-wide.
Potential Impact
The vulnerability allows authenticated manager users to bypass intended permission checks and manipulate site languages arbitrarily. This can lead to unauthorized deletion or modification of language settings, disrupting localized content and potentially causing site-wide content inconsistencies or loss of language-specific data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict manager user access to trusted personnel only and monitor for unauthorized language management activity.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-16T14:31:16.910Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad264132cdf04f65619958e
Added to database: 10/16/2026, 17:51:15 UTC
Last enriched: 10/16/2026, 18:33:50 UTC
Last updated: 10/16/2026, 19:03:25 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.