Threats tagged 'ghsa-8995-w3f5-5qpr'

Piranha CMS versions up to 12.2 have a missing authorization vulnerability in the Piranha.Manager LanguageApiController. This flaw allows any authenticated manager user to perform language management actions—listing, creating, editing, and deleting site languages—without requiring the specific granular permissions. Exploitation can lead to removal of languages and reassignment of sites to the default language, impacting localized content across the entire instance.