Unauthenticated Deinstallation Vulnerability in miniOrange Joomla Extensions by miniOrange
CVE-2026-78074

8.8HIGH

Key Information:

Vendor: Miniorgange.com
Status: Miniorange Oauth Client (free) Extension For Joomla; Joomshield By Miniorange (free) Extension For Joomla; Okta User Sync/bi-directional User Management (free) Extension For Joomla; Keycloak User Sync / User Management (free) Extension For Joomla
Vendor: CVE Published:; 31 August 2026

🔔 Create Miniorgange.com Vulnerability Alert

What is CVE-2026-78074?

A security vulnerability in the free versions of the miniOrange extensions for Joomla allows unauthenticated users to delete arbitrary installed extensions. The lack of proper authentication checks in these plugins exposes Joomla websites to risks, permitting unauthorized individuals to manipulate and remove critical site components without permission. This vulnerability highlights the importance of robust authentication mechanisms in safeguarding web applications.

Affected Version(s)

Custom API for Joomla (free) extension for Joomla 1.0.0-4.2

Import Export Users for Joomla (free) extension for Joomla 1.0.0-4.6

JoomAI - AI Assistant for Joomla (free) extension for Joomla 1.0.0-1.0.5

References

https://www.miniorange.com/

product

CVSS V4

Score:

8.8

Severity:

HIGH

Confidentiality:

None

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 31, 2026
Vulnerability Reserved
Aug 22, 2026

Credit

Krzysztof Zając, CERT PL

CVE-2026-78074 Data

JSON