# miniOrange SAML SSO (com_miniorange_saml) free edition 1.0.0 to 11.0.2 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

[Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-78074

CVE-2026-78074HighCVSS 8.8CVE published 31 August 2026Added to mySites.guru 31 August 2026

# miniOrange SAML SSO (com\_miniorange\_saml) free edition 1.0.0 to 11.0.2 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "SAML SSO for Joomla (free)", at the CVE's stated affected range 1.0.0-11.0.2. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange SAML SSO for Joomla to 11.0.3 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 11.0.3 with that release date. Connected sites have already been observed reporting 11.0.3. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

Copy citation

## Is my site affected?

CVE-2026-78074 is checked by 11 rules. Find the extension and release line your site runs:

Extension

Affected versions

Fixed in

What to do

[miniOrange SAML SSO](https://mysites.guru/vulnerabilities/miniorange-saml/)

from 1.0.0 up to and including 11.0.2

after 11.0.2

Update miniOrange SAML SSO to the newest release from the vendor. This flaw covers versions up to 11.0.2, so any later release is outside it.

[miniOrange OAuth Client](https://mysites.guru/vulnerabilities/miniorange-oauth/)

from 1.0.0 up to and including 3.2.0

after 3.2.0

Update miniOrange OAuth Client to the newest release from the vendor. This flaw covers versions up to 3.2.0, so any later release is outside it.

[miniOrange OAuth Client](https://mysites.guru/vulnerabilities/miniorange-oauth/)

from 1.0.0 up to and including 1.2.2

after 1.2.2

Update miniOrange OAuth Client to the newest release from the vendor. This flaw covers versions up to 1.2.2, so any later release is outside it.

[miniOrange OAuth Client](https://mysites.guru/vulnerabilities/miniorange-oauth/)

from 1.0.0 up to and including 5.1.5

after 5.1.5

Update miniOrange OAuth Client to the newest release from the vendor. This flaw covers versions up to 5.1.5, so any later release is outside it.

[miniOrange LDAP Integration](https://mysites.guru/vulnerabilities/miniorange-dirsync/)

from 1.0.0 up to and including 6.4.7

after 6.4.7

Update miniOrange LDAP Integration to the newest release from the vendor. This flaw covers versions up to 6.4.7, so any later release is outside it.

miniOrange Custom API

from 1.0.0 up to and including 4.2

after 4.2

Update miniOrange Custom API to the newest release from the vendor. This flaw covers versions up to 4.2, so any later release is outside it.

miniOrange Import Export Users

from 1.0.0 up to and including 4.6

after 4.6

Update miniOrange Import Export Users to the newest release from the vendor. This flaw covers versions up to 4.6, so any later release is outside it.

miniOrange Keycloak User Sync

from 1.0.0 up to and including 1.1.0

after 1.1.0

Update miniOrange Keycloak User Sync to the newest release from the vendor. This flaw covers versions up to 1.1.0, so any later release is outside it.

miniOrange Restrict Files / Folders

from 1.0.0 up to and including 3.7

after 3.7

Update miniOrange Restrict Files / Folders to the newest release from the vendor. This flaw covers versions up to 3.7, so any later release is outside it.

miniOrange SCIM User Provisioning

from 1.0.0 up to and including 4.0.5

after 4.0.5

Update miniOrange SCIM User Provisioning to the newest release from the vendor. This flaw covers versions up to 4.0.5, so any later release is outside it.

miniOrange Two Factor Authentication

from 1.0.0 up to and including 5.0.9

after 5.0.9

Update miniOrange Two Factor Authentication to the newest release from the vendor. This flaw covers versions up to 5.0.9, so any later release is outside it.

[Check whether your sites are affected](https://mysites.guru/free-audit/)

## How CVE-2026-78074 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

8.8 High

CVSS 4.0, scored by Joomla CNA

`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N`

### How it is reached

- **AV:N Attack vector** - Network. Reachable across the internet
- **AC:L Attack complexity** - Low. Nothing to work around, it just works
- **AT:N Attack requirements** - None. Works against any affected install
- **PR:N Privileges required** - None. No account needed
- **UI:N User interaction** - None. Nobody has to be tricked into anything

### What it does to the site

- **VC:N Confidentiality** - None. Nothing can be read
- **VI:H Integrity** - High. Data and files can be altered at will
- **VA:H Availability** - High. The site can be taken down

### What it does beyond the site

- **SC:N Confidentiality** - None. Other systems keep their data
- **SI:N Integrity** - None. Other systems keep their integrity
- **SA:N Availability** - None. Other systems stay up

## Timeline

1.  31 August 2026CVE-2026-78074 record published by its CNA
2.  31 August 2026mySites.guru check added for miniOrange SAML SSO (from 1.0.0 up to and including 11.0.2)
3.  31 August 2026mySites.guru check added for miniOrange OAuth Client (from 1.0.0 up to and including 3.2.0)
4.  31 August 2026mySites.guru check added for miniOrange OAuth Client (from 1.0.0 up to and including 1.2.2)
5.  31 August 2026mySites.guru check added for miniOrange OAuth Client (from 1.0.0 up to and including 5.1.5)
6.  31 August 2026mySites.guru check added for miniOrange LDAP Integration (from 1.0.0 up to and including 6.4.7)
7.  31 August 2026mySites.guru check added for miniOrange Custom API (from 1.0.0 up to and including 4.2)
8.  31 August 2026mySites.guru check added for miniOrange Import Export Users (from 1.0.0 up to and including 4.6)
9.  31 August 2026mySites.guru check added for miniOrange Keycloak User Sync (from 1.0.0 up to and including 1.1.0)
10.  31 August 2026mySites.guru check added for miniOrange Restrict Files / Folders (from 1.0.0 up to and including 3.7)
11.  31 August 2026mySites.guru check added for miniOrange SCIM User Provisioning (from 1.0.0 up to and including 4.0.5)
12.  31 August 2026mySites.guru check added for miniOrange Two Factor Authentication (from 1.0.0 up to and including 5.0.9)

## Rule details

High[CVE-2026-78074](https://mysites.guru/vulnerabilities/CVE-2026-78074/)2026-08-31

[miniOrange SAML SSO](https://mysites.guru/vulnerabilities/miniorange-saml/)

Affected versions: ≥ 1.0.0 and ≤ 11.0.2

Full advisory: [www.cve.org](https://www.cve.org/CVERecord?id=CVE-2026-78074)

High[CVE-2026-78074](https://mysites.guru/vulnerabilities/CVE-2026-78074/)2026-08-31

[miniOrange OAuth Client](https://mysites.guru/vulnerabilities/miniorange-oauth/) - miniOrange OAuth Client (com\_miniorange\_oauth) free edition 1.0.0 to 3.2.0 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "miniOrange Oauth Client (free)", at the CVE's stated affected range 1.0.0-3.2.0. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update the miniOrange OAuth Client to 3.2.1 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 3.2.1 with that release date. Note that 3.2.1 supersedes the 3.2.0 that fixed the separate CVE-2026-77995 account takeover, so a site sitting on 3.2.0 is patched for that flaw but still exposed to this one. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

Affected versions: ≥ 1.0.0 and ≤ 3.2.0

Full advisory: [www.cve.org](https://www.cve.org/CVERecord?id=CVE-2026-78074)

High[CVE-2026-78074](https://mysites.guru/vulnerabilities/CVE-2026-78074/)2026-08-31

[miniOrange OAuth Client](https://mysites.guru/vulnerabilities/miniorange-oauth/) - miniOrange Login with Azure AD / OAuth OIDC SSO (com\_miniorange\_oauth) free edition 1.0.0 to 1.2.2 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "OAuth Single Sign-On - OIDC SSO | Login with Azure AD (free)", at the CVE's stated affected range 1.0.0-1.2.2. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update OAuth Single Sign-On - OIDC SSO / Login with Azure AD to 1.2.3 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 1.2.3 with that release date. This product ships under the same com\_miniorange\_oauth element as the OAuth Client but on its own 1.x numbering, so it is matched on the display name rather than the element alone. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

Affected versions: ≥ 1.0.0 and ≤ 1.2.2

Full advisory: [www.cve.org](https://www.cve.org/CVERecord?id=CVE-2026-78074)

High[CVE-2026-78074](https://mysites.guru/vulnerabilities/CVE-2026-78074/)2026-08-31

[miniOrange OAuth Client](https://mysites.guru/vulnerabilities/miniorange-oauth/) - miniOrange OAuth Server (com\_miniorange\_oauth) free edition 1.0.0 to 5.1.5 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "OAuth Server for Joomla (free)", at the CVE's stated affected range 1.0.0-5.1.5. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange OAuth Server to 5.1.6 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 5.1.6 with that release date. This product ships under the same com\_miniorange\_oauth element as the OAuth Client, so it is matched on the display name rather than the element alone. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

Affected versions: ≥ 1.0.0 and ≤ 5.1.5

Full advisory: [www.cve.org](https://www.cve.org/CVERecord?id=CVE-2026-78074)

High[CVE-2026-78074](https://mysites.guru/vulnerabilities/CVE-2026-78074/)2026-08-31

[miniOrange LDAP Integration](https://mysites.guru/vulnerabilities/miniorange-dirsync/) - miniOrange LDAP Integration (com\_miniorange\_dirsync) free edition 1.0.0 to 6.4.7 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login (free)", at the CVE's stated affected range 1.0.0-6.4.7. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange LDAP Integration to 6.4.8 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 6.4.8 with that release date. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

Affected versions: ≥ 1.0.0 and ≤ 6.4.7

Full advisory: [www.cve.org](https://www.cve.org/CVERecord?id=CVE-2026-78074)

High[CVE-2026-78074](https://mysites.guru/vulnerabilities/CVE-2026-78074/)2026-08-31

miniOrange Custom API - miniOrange Custom API (com\_miniorange\_customapi) free edition 1.0.0 to 4.2 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "Custom API for Joomla (free)", at the CVE's stated affected range 1.0.0-4.2. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange Custom API to 4.3 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 4.3 with that release date. Connected sites have already been observed reporting 4.3. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

Affected versions: ≥ 1.0.0 and ≤ 4.2

Full advisory: [www.cve.org](https://www.cve.org/CVERecord?id=CVE-2026-78074)

High[CVE-2026-78074](https://mysites.guru/vulnerabilities/CVE-2026-78074/)2026-08-31

miniOrange Import Export Users - miniOrange Import Export Users (com\_miniorange\_importexportusers) free edition 1.0.0 to 4.6 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "Import Export Users for Joomla (free)", at the CVE's stated affected range 1.0.0-4.6. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange Import Export Users to 4.7 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 4.7 with that release date. The CVE record originally truncated this mid-number in its solution text ("Import Export Users for Joomla - 4."). We reported that to the Joomla CNA on 4 September 2026 and the record was corrected to 4.7 the same morning, which matches what miniOrange gave in writing and what the directory shows. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

Affected versions: ≥ 1.0.0 and ≤ 4.6

Full advisory: [www.cve.org](https://www.cve.org/CVERecord?id=CVE-2026-78074)

High[CVE-2026-78074](https://mysites.guru/vulnerabilities/CVE-2026-78074/)2026-08-31

miniOrange Keycloak User Sync - miniOrange Keycloak User Sync (com\_miniorange\_keycloaksync) free edition 1.0.0 to 1.1.0 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "Keycloak user sync / User management (free)", at the CVE's stated affected range 1.0.0-1.1.0. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange Keycloak User Sync to 1.1.1 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 1.1.1 with that release date. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

Affected versions: ≥ 1.0.0 and ≤ 1.1.0

Full advisory: [www.cve.org](https://www.cve.org/CVERecord?id=CVE-2026-78074)

High[CVE-2026-78074](https://mysites.guru/vulnerabilities/CVE-2026-78074/)2026-08-31

miniOrange Restrict Files / Folders - miniOrange Restrict Files / Folders / Media Access (com\_miniorange\_mediarestriction) free edition 1.0.0 to 3.7 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "Restrict Files / Folders / Media Access for Joomla (free)", at the CVE's stated affected range 1.0.0-3.7. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange Restrict Files / Folders / Media Access to 3.8 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 3.8 with that release date. miniOrange also market this extension as the Joomla Content Access Manager, which is the display name connected sites report for it. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

Affected versions: ≥ 1.0.0 and ≤ 3.7

Full advisory: [www.cve.org](https://www.cve.org/CVERecord?id=CVE-2026-78074)

High[CVE-2026-78074](https://mysites.guru/vulnerabilities/CVE-2026-78074/)2026-08-31

miniOrange SCIM User Provisioning - miniOrange SCIM User Provisioning (com\_miniorange\_scim) free edition 1.0.0 to 4.0.5 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "SCIM User Provisioning for Joomla (free)", at the CVE's stated affected range 1.0.0-4.0.5. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange SCIM User Provisioning to 4.0.6 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 4.0.6 with that release date. miniOrange ship more than one SCIM extension for Joomla and the standalone scim-user-provisioning plugin is versioned on a separate line, so this rule is deliberately confined to the com\_miniorange\_scim component. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

Affected versions: ≥ 1.0.0 and ≤ 4.0.5

Full advisory: [www.cve.org](https://www.cve.org/CVERecord?id=CVE-2026-78074)

High[CVE-2026-78074](https://mysites.guru/vulnerabilities/CVE-2026-78074/)2026-08-31

miniOrange Two Factor Authentication - miniOrange Two Factor Authentication (com\_miniorange\_twofa) free edition 1.0.0 to 5.0.9 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "Two Factor Authentication 2FA for Joomla (free)", at the CVE's stated affected range 1.0.0-5.0.9. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange Two Factor Authentication to 5.0.10 or later. miniOrange released the fix on 1 September 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 5.0.10 with that release date. The CVE record originally contradicted itself on this one, giving 5.1.0 in its HTML solution block against 5.0.10 in the plain-text one. We reported it to the Joomla CNA on 4 September 2026 and the record was corrected to 5.0.10 the same morning, which is what miniOrange gave in writing and what the directory shows. This release came a day later than the rest of the set. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

Affected versions: ≥ 1.0.0 and ≤ 5.0.9

Full advisory: [www.cve.org](https://www.cve.org/CVERecord?id=CVE-2026-78074)

## Other vulnerabilities in miniOrange SAML SSO, miniOrange OAuth Client and miniOrange LDAP Integration

Updating for CVE-2026-78074 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extensions.

### [miniOrange SAML SSO](https://mysites.guru/vulnerabilities/miniorange-saml/)

Latest safe version: 44.2

-   [CVE-2026-77998](https://mysites.guru/vulnerabilities/CVE-2026-77998/) Critical, from 1.0.0 up to but not including 11.0.2

### [miniOrange OAuth Client](https://mysites.guru/vulnerabilities/miniorange-oauth/)

-   [CVE-2026-77995](https://mysites.guru/vulnerabilities/CVE-2026-77995/) Critical, from 1.0.0 up to and including 3.1.9

### [miniOrange LDAP Integration](https://mysites.guru/vulnerabilities/miniorange-dirsync/)

-   [CVE-2023-23749](https://mysites.guru/vulnerabilities/CVE-2023-23749/) High, up to and including 5.0.2

## References

-   [CVE-2026-78074 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-78074)
-   [CVE-2026-78074 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-78074)

## CVE-2026-78074 questions

Show all

Which versions are affected by CVE-2026-78074?

[CVE-2026-78074](https://mysites.guru/vulnerabilities/CVE-2026-78074/) is covered by 11 rules: miniOrange SAML SSO from 1.0.0 up to and including 11.0.2; miniOrange OAuth Client from 1.0.0 up to and including 3.2.0; miniOrange OAuth Client from 1.0.0 up to and including 1.2.2; miniOrange OAuth Client from 1.0.0 up to and including 5.1.5; miniOrange LDAP Integration from 1.0.0 up to and including 6.4.7; miniOrange Custom API from 1.0.0 up to and including 4.2; miniOrange Import Export Users from 1.0.0 up to and including 4.6; miniOrange Keycloak User Sync from 1.0.0 up to and including 1.1.0; miniOrange Restrict Files / Folders from 1.0.0 up to and including 3.7; miniOrange SCIM User Provisioning from 1.0.0 up to and including 4.0.5; miniOrange Two Factor Authentication from 1.0.0 up to and including 5.0.9.

How do I fix CVE-2026-78074?

It depends on the extension and release line your site runs. For miniOrange SAML SSO from 1.0.0 up to and including 11.0.2: update miniOrange SAML SSO to the newest release from the vendor. This flaw covers versions up to 11.0.2, so any later release is outside it. For miniOrange OAuth Client from 1.0.0 up to and including 3.2.0: update miniOrange OAuth Client to the newest release from the vendor. This flaw covers versions up to 3.2.0, so any later release is outside it. For miniOrange OAuth Client from 1.0.0 up to and including 1.2.2: update miniOrange OAuth Client to the newest release from the vendor. This flaw covers versions up to 1.2.2, so any later release is outside it. For miniOrange OAuth Client from 1.0.0 up to and including 5.1.5: update miniOrange OAuth Client to the newest release from the vendor. This flaw covers versions up to 5.1.5, so any later release is outside it. For miniOrange LDAP Integration from 1.0.0 up to and including 6.4.7: update miniOrange LDAP Integration to the newest release from the vendor. This flaw covers versions up to 6.4.7, so any later release is outside it. For miniOrange Custom API from 1.0.0 up to and including 4.2: update miniOrange Custom API to the newest release from the vendor. This flaw covers versions up to 4.2, so any later release is outside it. For miniOrange Import Export Users from 1.0.0 up to and including 4.6: update miniOrange Import Export Users to the newest release from the vendor. This flaw covers versions up to 4.6, so any later release is outside it. For miniOrange Keycloak User Sync from 1.0.0 up to and including 1.1.0: update miniOrange Keycloak User Sync to the newest release from the vendor. This flaw covers versions up to 1.1.0, so any later release is outside it. For miniOrange Restrict Files / Folders from 1.0.0 up to and including 3.7: update miniOrange Restrict Files / Folders to the newest release from the vendor. This flaw covers versions up to 3.7, so any later release is outside it. For miniOrange SCIM User Provisioning from 1.0.0 up to and including 4.0.5: update miniOrange SCIM User Provisioning to the newest release from the vendor. This flaw covers versions up to 4.0.5, so any later release is outside it. For miniOrange Two Factor Authentication from 1.0.0 up to and including 5.0.9: update miniOrange Two Factor Authentication to the newest release from the vendor. This flaw covers versions up to 5.0.9, so any later release is outside it.

How severe is CVE-2026-78074?

Joomla CNA scores it 8.8 (High) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.

## Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day.

This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/).

Rules current as of 14 October 2026.