Vulnerability in Miniorgange.com Custom API For Joomla (Free) Extension
CVE-2026-78074
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.
Affected products
- Miniorgange.com Custom Api For Joomla (Free) Extension — versions 1.0.0-4.2
- Miniorgange.com Import Export Users For Joomla (Free) Extension — versions 1.0.0-4.6
- Miniorgange.com Joomai - Ai Assistant For Joomla (Free) Extension — versions 1.0.0-1.0.5
- Miniorgange.com Joomshield By Miniorange (Free) Extension For Joomla — versions 1.0.0-1.0.2
- Miniorgange.com Keycloak User Sync / Management (Free) Extension For Joomla — versions 1.0.0-1.1.0
- Miniorgange.com Ldap Integration With Active Directory And Openldap - Ntlm & Kerberos Login (Free) Extension For Joomla — versions 1.0.0-6.4.7
- Miniorgange.com Login With Keycloak Oauth Single Sign-on (Sso) | (Free) Extension For Joomla — versions 1.0.0-1.2.2
- Miniorgange.com Miniorange Oauth Client (Free) Extension For Joomla — versions 1.0.0-3.2.0
- Miniorgange.com Miniorange User Provisioning With Azure For Joomla (Free) Extension — versions 1.0.0-1.1.0
- Miniorgange.com Oauth Server For Joomla (Free) Extension — versions 1.0.0-5.1.5
Weakness classification (CWE)
References
- security@joomla.org (product)