CVE-2026-111665 in Piranha CMS
Summary
by MITRE • 10/16/2026
Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in Piranha CMS versions through 12.2 represents a critical failure in access control mechanisms within the administrative interface. Specifically, the LanguageApiController component lacks proper authorization checks for its core endpoints responsible for managing site languages. This flaw allows any user who has successfully authenticated as a manager to perform sensitive operations on language configurations without possessing the specific granular permissions required by design. The intended security model relies on role-based access control where actions such as listing, creating, editing, and deleting site languages are restricted to users with explicit LanguageAdd, LanguageEdit, or LanguageDelete privileges. However, due to this implementation error, these restrictions are effectively bypassed for any authenticated manager account regardless of their assigned roles or permission sets.
From a technical perspective, the root cause lies in the absence of authorization middleware or attribute checks on the API endpoints exposed by the LanguageApiController. In a secure architecture, each action within an administrative controller should verify that the current user session holds the necessary permissions before executing logic. Here, the Get, Save, and Delete actions are accessible to all authenticated managers. This means that once an attacker gains access with any manager-level credentials, they can directly invoke these API methods via HTTP requests. The system fails to validate whether the specific action being requested aligns with the user's authorized scope, leading to a classic insecure direct object reference scenario combined with broken access control logic.
The operational impact of this vulnerability is severe and potentially catastrophic for multi-lingual websites hosted on Piranha CMS. An attacker can exploit this flaw to delete existing language configurations or modify them in ways that disrupt site functionality. By removing languages, the system may revert content instances to a default state, causing localized pages to become inaccessible or display incorrectly. Furthermore, reassigning sites to the default language configuration can lead to data inconsistency and loss of localization context for end-users. This disruption affects the entire instance-wide availability and integrity of the web application's content structure, potentially leading to significant downtime and reputational damage for organizations relying on accurate multi-language support.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves a user possessing insufficient privileges yet being able to perform administrative actions they are not authorized to execute. It also maps directly to the MITRE ATT&CK technique T1078, specifically Valid Accounts, where an attacker uses legitimate credentials to access resources and perform unauthorized operations within the application's logic. The exploitation path is straightforward given that it requires only valid authentication, making it a high-risk issue for any deployment using Piranha CMS with multiple manager accounts or shared administrative credentials.
Mitigation strategies must focus on immediate patching and rigorous review of access control implementations. Administrators should upgrade to a version of Piranya CMS where this authorization flaw has been corrected by the vendor. In environments where upgrading is not immediately feasible, network-level controls such as Web Application Firewalls can be configured to restrict direct API access based on known exploit patterns or unusual request frequencies from manager accounts. Additionally, implementing strict logging and monitoring for language-related API calls can help detect exploitation attempts in real-time. Long-term remediation requires adopting a defense-in-depth approach where all administrative endpoints are audited against the principle of least privilege, ensuring that every action is explicitly validated against user roles before execution.