CVE-2026-78074
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.
- Published Aug 31, 2026
- CVSS 8.8 high
- 0.5% chance of exploitation in the next 30 days (EPSS)
Affected software
- miniorgange.com JoomShield by miniOrange extension for Joomla
- miniorgange.com Keycloak user sync / User management extension for Joomla
- miniorgange.com LDAP Integration with Active Directory and OpenLDAP
- miniorgange.com Login with Keycloak OAuth Single Sign-On
- miniorgange.com OAuth Single Sign-On
- miniorgange.com Okta User sync/Bi-directional user management extension for Joomla
- miniorgange.com Restrict Files / Folders / Media Access for Joomla extension for Joomla
- miniorgange.com SAML SP Single Sign On
- miniorgange.com SAML SSO login with google Apps extension for Joomla
- miniorgange.com Web3
- miniorgange.com miniOrange Oauth Client extension for Joomla
- miniorgange.com miniOrange User Provisioning with Azure for Joomla extension for Joomla