{"id":"CVE-2026-78074","title":"Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions","summary":"Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the f…","severity":"high","cvss":8.8,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-284"],"vendor":"miniorgange.com","product":"miniOrange Oauth Client (free) extension for Joomla","affected":["miniorange_oauth_client_free_extension_for_joomla 1.0.0-3.2.0","joomshield_by_miniorange_free_extension_for_joomla 1.0.0-1.0.2","okta_user_sync_bi-directional_user_management_free_extension_for_joomla 1.0.0-1.1.0","keycloak_user_sync_user_management_free_extension_for_joomla 1.0.0-1.1.0","restrict_files_folders_media_access_for_joomla_free_extension_for_joomla 1.0.0-3.7","ldap_integration_with_active_directory_and_openldap_-_ntlm_kerberos_login_free_extension_for_joomla 1.0.0-6.4.7","login_with_keycloak_oauth_single_sign-on_sso_login_with_keycloak_free_extension_for_joomla 1.0.0-1.2.2","saml_sso_login_with_google_apps_free_extension_for_joomla 1.0.0-6.4","saml_sp_single_sign_on_login_with_adfs_free_extension_for_joomla 1.0.0-6.4","web3_crypto_wallet_login_nft_token_gating_free_extension_for_joomla 1.0.0-3.5.1","oauth_single_sign-on_-_oidc_sso_login_with_azure_ad_free_extension_for_joomla 1.0.0-1.2.2","miniorange_user_provisioning_with_azure_for_joomla_free_extension_for_joomla 1.0.0-1.1.0","joomai_-_ai_assistant_for_joomla_free_extension_for_joomla 1.0.0-1.0.5","single_sign_on_for_educational_institutes_free_extension_for_joomla 1.0.0-1.2.2","two_factor_authentication_2fa_for_joomla_free_extension_for_joomla 1.0.0-5.0.9","otp_verification_for_joomla_free_extension_for_joomla 1.0.0-6.6","saml_2.0_idp_for_joomla_free_extension_for_joomla 1.0.0-7.7","staff_employee_business_directory_search_for_active_directory_free_extension_for_joomla 1.0.0-2.0.4","saml_sso_for_joomla_free_extension_for_joomla 1.0.0-11.0.2","oauth_server_for_joomla_free_extension_for_joomla 1.0.0-5.1.5","scim_user_provisioning_for_joomla_free_extension_for_joomla 1.0.0-4.0.4","custom_api_for_joomla_free_extension_for_joomla 1.0.0-4.2","import_export_users_for_joomla_free_extension_for_joomla 1.0.0-4.6"],"published":"2026-08-31","updated":"2026-09-08","sourceUpdated":"2026-09-08T11:17:44.700","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-78074","references":[{"url":"https://www.miniorange.com/","label":"security@joomla.org"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-08-31T14:23:16.710411Z"},"cvssSource":"cna","epss":0.0031,"epssPercentile":0.24021,"ingestedAt":"2026-09-08T15:33:26.955Z","slug":"CVE-2026-78074","body":"## Overview\n\nJoomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}