CVE-2026-111665
MediumCVSS 5.4Summary
Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.
Risk Assessment
Unauthorized deletion of languages and reassignment of sites to the default can break localized content instance-wide. This may lead to content unavailability for users and data loss.
Recommendation
Upgrade Piranha CMS beyond version 12.2 once a fixed release is available. Until then, enforce the Language, LanguageAdd, LanguageEdit and LanguageDelete permissions in LanguageApiController.
Other vulnerabilities in Piranha CMS
See all- CVE-2025-67291Medium
A stored cross-site scripting (XSS) vulnerability in the Media module of Piranha CMS v12.1 allows attackers to inject malicious JavaScript or HTML into the Name field, leading to script execution in victims' browsers.
- CVE-2025-67290Medium
A stored cross-site scripting (XSS) vulnerability exists in the Page Settings module of Piranha CMS v12.1. Attackers can inject malicious JavaScript or HTML into the Excerpt field, leading to script execution in victims' browsers.
Original NVD description (English source)
Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS