CVE-2026-111665

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111665
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111665.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111665
Published
2026-10-16T17:39:28Z
Modified
2026-10-20T02:30:50Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Piranha CMS through 12.2 Missing Authorization in Manager Language API
Details

Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111665.json"
}
References

Affected packages

Git / github.com/piranhacms/piranha.core

Affected ranges

Type
GIT
Repo
https://github.com/piranhacms/piranha.core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
7605efaef6b0e5abc6f0618f3099bc1510f48946
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "12.2"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v10.*
v10.0
v10.0-alpha1
v10.0.1
v10.0.2
v10.0.3
v10.0.4
v10.1
v10.2
v10.3
v10.4
v11.*
v11.0
v11.1
v12.*
v12.0
v12.1
v12.2
v4.*
v4.0.0
v4.0.0-alpha1
v4.0.0-alpha3
v4.0.0-alpha4
v4.0.0-alpha5
v4.0.0-alpha6
v4.0.0-alpha7
v4.0.0-alpha8
v4.0.0-alpha9
v4.0.0-beta1
v4.0.0-rc1
v4.0.1
v4.1.0
v4.1.0-alpha1
v4.1.0-beta1
v4.1.0-beta2
v4.2.0
v4.2.0-alpha1
v4.2.0-alpha2
v4.2.0-beta1
v4.2.1
v4.3.0
v4.3.0-beta1
v5.*
v5.0.0
v5.0.0-alpha1
v5.0.0-beta1
v5.0.1
v5.1.0
v5.1.0-alpha1
v5.1.0-beta1
v5.1.1
v5.1.2
v5.2.0
v5.2.0-beta1
v5.2.0-beta2
v5.2.1
v5.3.0
v5.3.0-beta1
v5.3.1
v5.4.0
v6.*
v6.0.0
v6.0.1
v6.0.2
v6.1.0
v7.*
v7.0-sr2
v7.0-sr3
v7.0-sr4
v7.0-sr5
v7.0.0
v7.0.0-alpha1
v7.0.0-alpha2
v7.0.0-beta1
v7.0.1
v7.1.0
v8.*
v8.0
v8.0-sr1
v8.1
v8.2
v8.3
v8.3-sr1
v8.3-sr2
v8.4
v8.4-sr1
v8.4-sr2
v8.4-sr3
v9.*
v9.0
v9.0-beta1
v9.0-rc1
v9.0-rc2
v9.0-sr1
v9.1
v9.1-alpha1
v9.1-alpha2
v9.1-beta1
v9.1-sr1
v9.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111665.json"