CVE-2026-78074

Summary

Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.

Affected Software

VendorProductVersion RangeStatus
miniorgange.comminiOrange Oauth Client (free) extension for Joomla1.0.0-3.2.0affected
miniorgange.comJoomShield by miniOrange (free) extension for Joomla1.0.0-1.0.2affected
miniorgange.comOkta User sync/Bi-directional user management (free) extension for Joomla1.0.0-1.1.0affected
miniorgange.comKeycloak user sync / User management (free) extension for Joomla1.0.0-1.1.0affected
miniorgange.comRestrict Files / Folders / Media Access for Joomla (free) extension for Joomla1.0.0-3.7affected
miniorgange.comLDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login (free) extension for Joomla1.0.0-6.4.7affected
miniorgange.comLogin with Keycloak OAuth Single Sign-On (SSO)Login with Keycloak (free) extension for Joomla1.0.0-1.2.2
miniorgange.comSAML SSO login with google Apps (free) extension for Joomla1.0.0-6.4affected
miniorgange.comSAML SP Single Sign On – Login with ADFS (free) extension for Joomla1.0.0-6.4affected
miniorgange.comWeb3 – Crypto wallet Login & NFT token gating (free) extension for Joomla1.0.0-3.5.1affected
miniorgange.comOAuth Single Sign-On - OIDC SSOLogin with Azure AD (free) extension for Joomla1.0.0-1.2.2
miniorgange.comminiOrange User Provisioning with Azure for Joomla (free) extension for Joomla1.0.0-1.1.0affected
miniorgange.comJoomAI - AI Assistant for Joomla (free) extension for Joomla1.0.0-1.0.5affected
miniorgange.comSingle Sign On for Educational Institutes (free) extension for Joomla1.0.0-1.2.2affected
miniorgange.comTwo Factor Authentication 2FA for Joomla (free) extension for Joomla1.0.0-5.0.9affected
miniorgange.comOTP Verification For Joomla (free) extension for Joomla1.0.0-6.6affected
miniorgange.comSAML 2.0 IDP for Joomla (free) extension for Joomla1.0.0-7.7affected
miniorgange.comStaff/Employee Business Directory Search for Active Directory (free) extension for Joomla1.0.0-2.0.4affected
miniorgange.comSAML SSO for Joomla (free) extension for Joomla1.0.0-11.0.2affected
miniorgange.comOAuth Server for Joomla (free) extension for Joomla1.0.0-5.1.5affected
miniorgange.comSCIM User Provisioning for Joomla (free) extension for Joomla1.0.0-4.0.5affected
miniorgange.comCustom API for Joomla (free) extension for Joomla1.0.0-4.2affected
miniorgange.comImport Export Users for Joomla (free) extension for Joomla1.0.0-4.6affected

Weaknesses

  • CWE-284: CWE-284 Improper Access Control

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References