---
id: CVE-2026-78074
title: >-
  Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension
  deinstallation via various miniOrange extensions - a missing authentication
  check allows unauthenticated actors to delete arbitrary installed extensions
summary: >-
  Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension
  deinstallation via various miniOrange extensions - a missing authentication
  check allows unauthenticated actors to delete arbitrary installed extensions.
  Only the f…
severity: high
cvss: 8.8
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-284
vendor: miniorgange.com
product: miniOrange Oauth Client (free) extension for Joomla
affected:
  - miniorange_oauth_client_free_extension_for_joomla 1.0.0-3.2.0
  - joomshield_by_miniorange_free_extension_for_joomla 1.0.0-1.0.2
  - >-
    okta_user_sync_bi-directional_user_management_free_extension_for_joomla
    1.0.0-1.1.0
  - keycloak_user_sync_user_management_free_extension_for_joomla 1.0.0-1.1.0
  - >-
    restrict_files_folders_media_access_for_joomla_free_extension_for_joomla
    1.0.0-3.7
  - >-
    ldap_integration_with_active_directory_and_openldap_-_ntlm_kerberos_login_free_extension_for_joomla
    1.0.0-6.4.7
  - >-
    login_with_keycloak_oauth_single_sign-on_sso_login_with_keycloak_free_extension_for_joomla
    1.0.0-1.2.2
  - saml_sso_login_with_google_apps_free_extension_for_joomla 1.0.0-6.4
  - saml_sp_single_sign_on_login_with_adfs_free_extension_for_joomla 1.0.0-6.4
  - >-
    web3_crypto_wallet_login_nft_token_gating_free_extension_for_joomla
    1.0.0-3.5.1
  - >-
    oauth_single_sign-on_-_oidc_sso_login_with_azure_ad_free_extension_for_joomla
    1.0.0-1.2.2
  - >-
    miniorange_user_provisioning_with_azure_for_joomla_free_extension_for_joomla
    1.0.0-1.1.0
  - joomai_-_ai_assistant_for_joomla_free_extension_for_joomla 1.0.0-1.0.5
  - >-
    single_sign_on_for_educational_institutes_free_extension_for_joomla
    1.0.0-1.2.2
  - >-
    two_factor_authentication_2fa_for_joomla_free_extension_for_joomla
    1.0.0-5.0.9
  - otp_verification_for_joomla_free_extension_for_joomla 1.0.0-6.6
  - saml_2.0_idp_for_joomla_free_extension_for_joomla 1.0.0-7.7
  - >-
    staff_employee_business_directory_search_for_active_directory_free_extension_for_joomla
    1.0.0-2.0.4
  - saml_sso_for_joomla_free_extension_for_joomla 1.0.0-11.0.2
  - oauth_server_for_joomla_free_extension_for_joomla 1.0.0-5.1.5
  - scim_user_provisioning_for_joomla_free_extension_for_joomla 1.0.0-4.0.4
  - custom_api_for_joomla_free_extension_for_joomla 1.0.0-4.2
  - import_export_users_for_joomla_free_extension_for_joomla 1.0.0-4.6
published: '2026-08-31'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T11:17:44.700'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78074'
references:
  - url: 'https://www.miniorange.com/'
    label: security@joomla.org
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-08-31T14:23:16.710411Z'
cvssSource: cna
epss: 0.0031
epssPercentile: 0.24107
ingestedAt: '2026-09-08T15:33:26.955Z'
---

## Overview

Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.