Description
Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.
Published: 2026-10-16
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Missing Authorization
Action: Patch
AI Analysis

Impact

An authentication bypass flaw exists in the LanguageApiController of Piranha CMS, allowing any authenticated manager account to list, add, modify, and delete site languages without the required Language, LanguageAdd, LanguageEdit, or LanguageDelete permissions. This lack of authorization can lead to uncontrolled manipulation of localized content, potentially causing loss of language data and reassigning site content to the default language across the entire website.

Affected Systems

All installations of Piranha CMS up to and including version 12.2 are affected. Users operating these versions on any supported platform are at risk.

Risk and Exploitability

The CVSS base score of 5.3 signals moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV. Attackers only need manager-level authentication to call the /manager/api/language Get, Save, and Delete endpoints, making exploitation straightforward and capable of affecting all localized content site‑wide.

Generated by OpenCVE AI on October 16, 2026 at 19:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest Piranha CMS release that fixes the missing permission flaw (v12.3 or later).
  • Enforce granular language permissions by configuring the manager API to require Language, LanguageAdd, LanguageEdit, and LanguageDelete roles for all language operations.
  • If an immediate patch is not possible, protect the /manager/api/language endpoints with network‑level controls such as firewall rules or reverse‑proxy authentication to allow access only from trusted IP ranges or VPNs.

Generated by OpenCVE AI on October 16, 2026 at 19:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.
Title Piranha CMS through 12.2 Missing Authorization in Manager Language API
First Time appeared Dotnetfoundation
Dotnetfoundation piranha Cms
Weaknesses CWE-862
CPEs cpe:2.3:a:dotnetfoundation:piranha_cms:*:*:*:*:*:*:*:*
Vendors & Products Dotnetfoundation
Dotnetfoundation piranha Cms
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Dotnetfoundation Piranha Cms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-19T13:23:30.162Z

Reserved: 2026-10-16T14:31:16.910Z

Link: CVE-2026-111665

cve-icon Vulnrichment

Updated: 2026-10-19T13:23:21.919Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T18:17:48.363

Modified: 2026-10-19T14:16:58.967

Link: CVE-2026-111665

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T15:30:06Z

Weaknesses