CVE-2026-78074
Unauthenticated arbitrary extension deinstallation via various miniOrange extensions
HIGH
Extension Joomla — miniorgange.com
Source officielle
Description
Joomla Extension - miniorgange.com - Unauthenticated arbitrary extension deinstallation via various miniOrange extensions - a missing authentication check allows unauthenticated actors to delete arbitrary installed extensions. Only the free versions of the miniOrange plugins are affected.
Sévérité
8.8
Élevée · CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Score retenu : NVD
| Source | Sévérité d'origine | CVSS |
|---|---|---|
| NVD | HIGH | 8.8 (v4.0) |
Produit et versions
- Produit
- Extension Joomla — miniorgange.com
- Corrigée dans
- Non précisée
- Publiée
- 31/08/2026
- Modifiée
- 08/09/2026
- CWE
- CWE-284
Versions concernées
- miniOrange Oauth Client (free) extension for Joomla — 1.0.0 – 3.2.0
- JoomShield by miniOrange (free) extension for Joomla — 1.0.0 – 1.0.2
- Okta User sync/Bi-directional user management (free) extension for Joomla — 1.0.0 – 1.1.0
- Keycloak user sync / User management (free) extension for Joomla — 1.0.0 – 1.1.0
- Restrict Files / Folders / Media Access for Joomla (free) extension for Joomla — 1.0.0 – 3.7
- LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login (free) extension for Joomla — 1.0.0 – 6.4.7
- Login with Keycloak OAuth Single Sign-On (SSO) | Login with Keycloak (free) extension for Joomla — 1.0.0 – 1.2.2
- SAML SSO login with google Apps (free) extension for Joomla — 1.0.0 – 6.4
- SAML SP Single Sign On – Login with ADFS (free) extension for Joomla — 1.0.0 – 6.4
- Web3 – Crypto wallet Login & NFT token gating (free) extension for Joomla — 1.0.0 – 3.5.1
- OAuth Single Sign-On - OIDC SSO | Login with Azure AD (free) extension for Joomla — 1.0.0 – 1.2.2
- miniOrange User Provisioning with Azure for Joomla (free) extension for Joomla — 1.0.0 – 1.1.0
11 autres
- JoomAI - AI Assistant for Joomla (free) extension for Joomla — 1.0.0 – 1.0.5
- Single Sign On for Educational Institutes (free) extension for Joomla — 1.0.0 – 1.2.2
- Two Factor Authentication 2FA for Joomla (free) extension for Joomla — 1.0.0 – 5.0.9
- OTP Verification For Joomla (free) extension for Joomla — 1.0.0 – 6.6
- SAML 2.0 IDP for Joomla (free) extension for Joomla — 1.0.0 – 7.7
- Staff/Employee Business Directory Search for Active Directory (free) extension for Joomla — 1.0.0 – 2.0.4
- SAML SSO for Joomla (free) extension for Joomla — 1.0.0 – 11.0.2
- OAuth Server for Joomla (free) extension for Joomla — 1.0.0 – 5.1.5
- SCIM User Provisioning for Joomla (free) extension for Joomla — 1.0.0 – 4.0.4
- Custom API for Joomla (free) extension for Joomla — 1.0.0 – 4.2
- Import Export Users for Joomla (free) extension for Joomla — 1.0.0 – 4.6
Sources
- NVD CNA Joomla CVE-2026-78074 vu
Ces informations proviennent des sources ci-dessus ; CVE Oyer n'y ajoute aucune interprétation.
Historique
- Détectée via nvd26/09/2026 09:34 UTC