Vulnerability in Miniorgange.com Custom API For Joomla (Free) Extension
CVE-2026-78074
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.
Published · last modified .
EPSS exploit prediction
EPSS: 0.005 (44.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 44th percentile — 44.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.002
Affected products
- Miniorgange.com Custom API For Joomla (Free) Extension — versions 1.0.0-4.2
- Miniorgange.com Import Export Users For Joomla (Free) Extension — versions 1.0.0-4.6
- Miniorgange.com Joomai - Ai Assistant For Joomla (Free) Extension — versions 1.0.0-1.0.5
- Miniorgange.com Joomshield By Miniorange (Free) Extension For Joomla — versions 1.0.0-1.0.2
- Miniorgange.com Keycloak User Sync / Management (Free) Extension For Joomla — versions 1.0.0-1.1.0
- Miniorgange.com Ldap Integration With Active Directory And Openldap - Ntlm & Kerberos Login (Free) Extension For Joomla — versions 1.0.0-6.4.7
- Miniorgange.com Login With Keycloak Oauth Single Sign-On (Sso) | (Free) Extension For Joomla — versions 1.0.0-1.2.2
- Miniorgange.com Miniorange Oauth Client (Free) Extension For Joomla — versions 1.0.0-3.2.0
- Miniorgange.com Miniorange User Provisioning With Azure For Joomla (Free) Extension — versions 1.0.0-1.1.0
- Miniorgange.com Oauth Server For Joomla (Free) Extension — versions 1.0.0-5.1.5
Weakness classification (CWE)
References
- www.miniorange.com/ (product)