Improper access control in miniorgange.com miniOrange Oauth Client extension for Joomla
Priority MEDIUM 45CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.
Summary
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00543 45th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| miniorgange.com | miniOrange Oauth Client (free) extension for Joomla | 1.0.0-3.2.0 | — | No fix listed | CNA |
| miniorgange.com | JoomShield by miniOrange (free) extension for Joomla | 1.0.0-1.0.2 | — | No fix listed | CNA |
| miniorgange.com | Okta User sync/Bi-directional user management (free) extension for Joomla | 1.0.0-1.1.0 | — | No fix listed | CNA |
| miniorgange.com | Keycloak user sync / User management (free) extension for Joomla | 1.0.0-1.1.0 | — | No fix listed | CNA |
| miniorgange.com | Restrict Files / Folders / Media Access for Joomla (free) extension for Joomla | 1.0.0-3.7 | — | No fix listed | CNA |
| miniorgange.com | LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login (free) extension for Joomla | 1.0.0-6.4.7 | — | No fix listed | CNA |
| miniorgange.com | Login with Keycloak OAuth Single Sign-On (SSO) | Login with Keycloak (free) extension for Joomla | 1.0.0-1.2.2 | — | No fix listed | CNA |
| miniorgange.com | SAML SSO login with google Apps (free) extension for Joomla | 1.0.0-6.4 | — | No fix listed | CNA |
| miniorgange.com | SAML SP Single Sign On – Login with ADFS (free) extension for Joomla | 1.0.0-6.4 | — | No fix listed | CNA |
| miniorgange.com | Web3 – Crypto wallet Login & NFT token gating (free) extension for Joomla | 1.0.0-3.5.1 | — | No fix listed | CNA |
| miniorgange.com | OAuth Single Sign-On - OIDC SSO | Login with Azure AD (free) extension for Joomla | 1.0.0-1.2.2 | — | No fix listed | CNA |
| miniorgange.com | miniOrange User Provisioning with Azure for Joomla (free) extension for Joomla | 1.0.0-1.1.0 | — | No fix listed | CNA |
| miniorgange.com | JoomAI - AI Assistant for Joomla (free) extension for Joomla | 1.0.0-1.0.5 | — | No fix listed | CNA |
| miniorgange.com | Single Sign On for Educational Institutes (free) extension for Joomla | 1.0.0-1.2.2 | — | No fix listed | CNA |
| miniorgange.com | Two Factor Authentication 2FA for Joomla (free) extension for Joomla | 1.0.0-5.0.9 | — | No fix listed | CNA |
| miniorgange.com | OTP Verification For Joomla (free) extension for Joomla | 1.0.0-6.6 | — | No fix listed | CNA |
| miniorgange.com | SAML 2.0 IDP for Joomla (free) extension for Joomla | 1.0.0-7.7 | — | No fix listed | CNA |
| miniorgange.com | Staff/Employee Business Directory Search for Active Directory (free) extension for Joomla | 1.0.0-2.0.4 | — | No fix listed | CNA |
| miniorgange.com | SAML SSO for Joomla (free) extension for Joomla | 1.0.0-11.0.2 | — | No fix listed | CNA |
| miniorgange.com | OAuth Server for Joomla (free) extension for Joomla | 1.0.0-5.1.5 | — | No fix listed | CNA |
| miniorgange.com | SCIM User Provisioning for Joomla (free) extension for Joomla | 1.0.0-4.0.4 | — | No fix listed | CNA |
| miniorgange.com | Custom API for Joomla (free) extension for Joomla | 1.0.0-4.2 | — | No fix listed | CNA |
| miniorgange.com | Import Export Users for Joomla (free) extension for Joomla | 1.0.0-4.6 | — | No fix listed | CNA |
- miniOrange Oauth Client (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-3.2.0 Fixed in — No fix listed CNA
- JoomShield by miniOrange (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-1.0.2 Fixed in — No fix listed CNA
- Okta User sync/Bi-directional user management (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-1.1.0 Fixed in — No fix listed CNA
- Keycloak user sync / User management (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-1.1.0 Fixed in — No fix listed CNA
- Restrict Files / Folders / Media Access for Joomla (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-3.7 Fixed in — No fix listed CNA
- LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-6.4.7 Fixed in — No fix listed CNA
- Login with Keycloak OAuth Single Sign-On (SSO) | Login with Keycloak (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-1.2.2 Fixed in — No fix listed CNA
- SAML SSO login with google Apps (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-6.4 Fixed in — No fix listed CNA
- SAML SP Single Sign On – Login with ADFS (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-6.4 Fixed in — No fix listed CNA
- Web3 – Crypto wallet Login & NFT token gating (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-3.5.1 Fixed in — No fix listed CNA
- OAuth Single Sign-On - OIDC SSO | Login with Azure AD (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-1.2.2 Fixed in — No fix listed CNA
- miniOrange User Provisioning with Azure for Joomla (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-1.1.0 Fixed in — No fix listed CNA
- JoomAI - AI Assistant for Joomla (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-1.0.5 Fixed in — No fix listed CNA
- Single Sign On for Educational Institutes (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-1.2.2 Fixed in — No fix listed CNA
- Two Factor Authentication 2FA for Joomla (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-5.0.9 Fixed in — No fix listed CNA
- OTP Verification For Joomla (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-6.6 Fixed in — No fix listed CNA
- SAML 2.0 IDP for Joomla (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-7.7 Fixed in — No fix listed CNA
- Staff/Employee Business Directory Search for Active Directory (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-2.0.4 Fixed in — No fix listed CNA
- SAML SSO for Joomla (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-11.0.2 Fixed in — No fix listed CNA
- OAuth Server for Joomla (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-5.1.5 Fixed in — No fix listed CNA
- SCIM User Provisioning for Joomla (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-4.0.4 Fixed in — No fix listed CNA
- Custom API for Joomla (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-4.2 Fixed in — No fix listed CNA
- Import Export Users for Joomla (free) extension for Joomla Vendorminiorgange.com Affected 1.0.0-4.6 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-78074
- 2026-10-03 Alias added: GHSA-34gh-p34w-7wgq
References
Other 1
Sources
- CVE-2026-78074 · CVE Program
- CVE-2026-78074 · NVD
- FIRST EPSS
- GHSA-34gh-p34w-7wgq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences