Piranha CMS CVE-2026-111665

Exploitation requires an authenticated Piranha CMS manager account (PR:L) that can reach the manager/api/language endpoints; it does NOT require the account to hold the granular Language, LanguageAdd, LanguageEdit, or LanguageDelete permissions - that missing permission check is the vulnerability itself. The attacker directly calls the Get, Save, and Delete actions of the LanguageApiController. Limiting factors: the attacker must already possess valid manager-level credentials (no anonymous/unauthenticated path), affected versions are Piranha CMS through 12.2, and impact is confined to language configuration and the localized content that depends on it (no confidentiality exposure).

This is a genuine but modest-severity issue best treated as a medium-priority hardening fix rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires PR:L - a valid authenticated manager account - so this is a horizontal/privilege-scope flaw usable by any logged-in manager, not an anonymous internet attack. Impact is bounded: VC:N (no confidentiality loss), VI:L and VA:L (limited integrity and availability impact on localized content only), with no scope change (SC/SI/SA:N), which is why the score sits at 5.3 (Medium). No EPSS score, KEV listing, or vendor-confirmed exploitation was provided in the input, and no public exploit code is indicated. The signals are internally consistent - there is no conflict between the CVSS vector and the description (both agree on authenticated, network-based, integrity/availability-limited impact). The practical risk hinges entirely on how trusted the manager-user population is: in deployments where any lower-privileged manager account exists, this breaks the intended granular Language/LanguageAdd/LanguageEdit/LanguageDelete permission model and lets such a user disrupt site localization instance-wide.

A low-privileged but authenticated Piranha CMS manager user - one deliberately NOT granted Language permissions - directly invokes the manager/api/language Get, Save, and Delete endpoints to enumerate, modify, and delete configured site languages. By deleting languages, the attacker forces affected sites to fall back to the default language, corrupting or removing localized content across the entire instance. No public proof-of-concept exploit code is identified at time of analysis, though a technical write-up describing the flaw is referenced.