CVE-2026-78074: CWE-284 Improper Access Control in miniorgange.com miniOrange Oauth Client (free) extension for Joomla
Description
The miniOrange Oauth Client (free) extension for Joomla contains an improper access control vulnerability that allows unauthenticated attackers to uninstall arbitrary installed extensions. This issue affects only the free versions of the miniOrange plugins and arises from a missing authentication check. The vulnerability has a high severity score of 8.8 CVSS 4.0 and can lead to significant impact by enabling attackers to disrupt Joomla installations by removing extensions without authorization.
CVSS v4.0
Score 8.8high
Affected software
miniorgange.com
miniOrange Oauth Client (free) extension for Joomla
miniorgange.com
JoomShield by miniOrange (free) extension for Joomla
miniorgange.com
Okta User sync/Bi-directional user management (free) extension for Joomla
miniorgange.com
Keycloak user sync / User management (free) extension for Joomla
miniorgange.com
Restrict Files / Folders / Media Access for Joomla (free) extension for Joomla
miniorgange.com
LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login (free) extension for Joomla
miniorgange.com
Login with Keycloak OAuth Single Sign-On (SSO) | Login with Keycloak (free) extension for Joomla
miniorgange.com
SAML SSO login with google Apps (free) extension for Joomla
miniorgange.com
SAML SP Single Sign On – Login with ADFS (free) extension for Joomla
miniorgange.com
Web3 – Crypto wallet Login & NFT token gating (free) extension for Joomla
miniorgange.com
OAuth Single Sign-On - OIDC SSO | Login with Azure AD (free) extension for Joomla
miniorgange.com
miniOrange User Provisioning with Azure for Joomla (free) extension for Joomla
miniorgange.com
JoomAI - AI Assistant for Joomla (free) extension for Joomla
miniorgange.com
Single Sign On for Educational Institutes (free) extension for Joomla
miniorgange.com
Two Factor Authentication 2FA for Joomla (free) extension for Joomla
miniorgange.com
OTP Verification For Joomla (free) extension for Joomla
miniorgange.com
SAML 2.0 IDP for Joomla (free) extension for Joomla
miniorgange.com
Staff/Employee Business Directory Search for Active Directory (free) extension for Joomla
miniorgange.com
SAML SSO for Joomla (free) extension for Joomla
miniorgange.com
OAuth Server for Joomla (free) extension for Joomla
miniorgange.com
SCIM User Provisioning for Joomla (free) extension for Joomla
miniorgange.com
Custom API for Joomla (free) extension for Joomla
miniorgange.com
Import Export Users for Joomla (free) extension for Joomla
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-78074 is an improper access control vulnerability (CWE-284) in the miniOrange Oauth Client (free) extension for Joomla. Due to a missing authentication check, unauthenticated actors can arbitrarily uninstall installed extensions. This vulnerability affects multiple specific versions of the free miniOrange plugins. The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and high impact on integrity and availability.
Potential Impact
An unauthenticated attacker can delete arbitrary installed extensions in Joomla using the affected miniOrange free plugins. This can lead to disruption of website functionality and potential denial of service by removing critical extensions. The integrity and availability of the Joomla installation are impacted.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the vendor's announcements for updates. Until a fix is available, restricting access to the Joomla administration interface and minimizing exposure of the affected extensions may reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Joomla
- Date Reserved
- 2026-08-22T14:23:37.801Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a958ab9acd9273b492f08c3
Added to database: 08/31/2026, 14:07:53 UTC
Last enriched: 09/15/2026, 01:19:39 UTC
Last updated: 10/14/2026, 06:48:20 UTC
Views: 79
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.