CVE-2026-111665 Details

A missing authorization vulnerability has been identified in Piranha CMS versions through 12.2, specifically within the LanguageApiController of the Piranha.Manager component. This vulnerability allows any authenticated manager user to list, create, edit, and delete site languages without possessing the necessary granular permissions for language management. The issue arises because the LanguageApiController actions do not include the required authorization policies, leaving a gap that allows limited manager users to manipulate language data instance-wide. Exploitation of this vulnerability can disrupt localized content and affect the language assignments of all sites within the CMS.

The vulnerability can be addressed by adding the appropriate authorization policies to the LanguageApiController actions. Each action should be gated with the relevant Language permission, ensuring that only users with the correct authorizations can perform these language management tasks.