# miniOrange LDAP Integration security vulnerabilities

[Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/miniOrange LDAP Integration

# miniOrange LDAP Integration security vulnerabilities

mySites.guru tracks 2 vulnerabilities in miniOrange LDAP Integration (com\_miniorange\_dirsync), covering 2 CVEs. Every connected Joomla site is checked against them on each audit.

## Is my site affected?

Your site is affected if it runs miniOrange LDAP Integration in any of these ranges:

-   from 1.0.0 up to and including 6.4.7
-   up to and including 5.0.2

- **Latest safe version** - The rules here cover more than one release line, so there is no single version that clears all of them. Use the fixed release listed for the line your site runs.
- **What to do** - Update to the fixed release listed for your version in the table below, or to the newest release from the vendor. Where a range has no fix recorded, check the vendor's release notes before keeping miniOrange LDAP Integration installed.

[Check whether your sites are affected](https://mysites.guru/free-audit/)

## Every miniOrange LDAP Integration vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVE

Affected versions

Fixed in

Severity

Added

[CVE-2026-78074](https://mysites.guru/vulnerabilities/CVE-2026-78074/)CVSS 8.8

from 1.0.0 up to and including 6.4.7

after 6.4.7

High

2026-08-31

[CVE-2023-23749](https://mysites.guru/vulnerabilities/CVE-2023-23749/)CVSS 7.5

up to and including 5.0.2

update to 6.0.0

High

2023-01-17

## What we check for

High[CVE-2026-78074](https://mysites.guru/vulnerabilities/CVE-2026-78074/)2026-08-31

### miniOrange LDAP Integration (com\_miniorange\_dirsync) free edition 1.0.0 to 6.4.7 - Unauthenticated Arbitrary Extension Uninstallation (Denial of Service)

CERT PL (Krzysztof Zajac) reported that a large set of miniOrange Joomla extensions expose an endpoint with a missing authentication check, letting an unauthenticated attacker uninstall any extension installed on the site (CWE-284 Improper Access Control, CVSS 4.0 base score 8.8 High, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H). Uninstalling an extension takes its functionality offline and, on most Joomla extensions, runs its uninstall script and drops its database tables, so this is a remote, unauthenticated, destructive denial of service that can be pointed at any component, module or plugin on the site - security and login extensions included. There is no confidentiality impact: the attacker deletes, it does not read. CVE-2026-78074 names 23 miniOrange Joomla extensions and states explicitly that ONLY THE FREE editions are affected. This rule covers one of them, "LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login (free)", at the CVE's stated affected range 1.0.0-6.4.7. miniOrange numbers its paid editions in decades on the same element (builds such as 12.x, 21.x, 22.x, 32.x, 34.x and 44.x are in the wild on these components), and those sit above this ceiling, so they are deliberately not flagged - consistent with the CVE limiting the flaw to the free editions. FIXED: update miniOrange LDAP Integration to 6.4.8 or later. miniOrange released the fix on 31 August 2026. This was verified independently of the vendor's own claim: the Joomla Extensions Directory listing for this extension shows 6.4.8 with that release date. This rule's upper bound is the last version known to be AFFECTED, not the fix version, so any site inside the range still needs the update. If you cannot update immediately, uninstall the extension where it is not actually in use, and otherwise block unauthenticated access to the component's endpoints at the web application firewall or web server.

Affected versions: ≥ 1.0.0 and ≤ 6.4.7

Full advisory: [www.cve.org](https://www.cve.org/CVERecord?id=CVE-2026-78074)

High[CVE-2023-23749](https://mysites.guru/vulnerabilities/CVE-2023-23749/)2023-01-17

### LDAP Integration with Active Directory and OpenLDAP (com\_miniorange\_dirsync) <= 5.0.2 - Unauthenticated LDAP Injection

The miniOrange "LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login" extension does not sanitise the username POST parameter before building the LDAP query, so an unauthenticated attacker can inject LDAP filter syntax at the login form and dump arbitrary contents from the directory (CVE-2023-23749, CVSS 3.1 7.5 HIGH, AV:N/AC:L/PR:N/UI:N). The Joomla CNA records 5.0.2 as affected and 6.0.0 as unaffected; 5.0.2 is the only version the CNA tested, so this rule flags 5.0.2 and anything below it, which is the safe superset. The extension installs as a bundle whose component, System plugin (miniorangedirsync) and Authentication plugin (moldap) all carry the same version number, so the component version is a reliable indicator of the bundle version even though the injection itself is in the authentication path. Update to 6.0.0 or later.

Affected versions: ≤ 5.0.2

Full advisory: [extensions.joomla.org](https://extensions.joomla.org/vulnerable-extensions/resolved/ldap-integration-with-active-directory-and-openldap-ntlm-kerberos-login-5-0-2-other/)

## Timeline

1.  17 January 2023Check added for CVE-2023-23749 (up to and including 5.0.2)
2.  17 January 2023[CVE-2023-23749 record published](https://mysites.guru/vulnerabilities/CVE-2023-23749/)
3.  31 August 2026Check added for CVE-2026-78074 (from 1.0.0 up to and including 6.4.7)
4.  31 August 2026[CVE-2026-78074 record published](https://mysites.guru/vulnerabilities/CVE-2026-78074/)

## References

-   [cve.org/CVERecord?id=CVE-2026-78074](https://www.cve.org/CVERecord?id=CVE-2026-78074)
-   [extensions.joomla.org/vulnerable-extensions/resolved/ldap-integration](https://extensions.joomla.org/vulnerable-extensions/resolved/ldap-integration-with-active-directory-and-openldap-ntlm-kerberos-login-5-0-2-other/)

Each CVE page above links its official cve.org record and its NVD entry.

## miniOrange LDAP Integration vulnerability questions

Show all

Which versions of miniOrange LDAP Integration are vulnerable?

mySites.guru tracks 2 vulnerabilities in miniOrange LDAP Integration (com\_miniorange\_dirsync). A site is affected if its installed version is in any of these ranges: from 1.0.0 up to and including 6.4.7; up to and including 5.0.2.

What is the latest safe version of miniOrange LDAP Integration?

The rules here cover more than one release line, so there is no single version that clears all of them. Use the fixed release listed for the line your site runs.

How do I check which version of miniOrange LDAP Integration my Joomla site runs?

The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com\_miniorange\_dirsync. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules.

## Running miniOrange LDAP Integration on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day.

This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/).

CVE identifiers: [CVE-2026-78074](https://mysites.guru/vulnerabilities/CVE-2026-78074/), [CVE-2023-23749](https://mysites.guru/vulnerabilities/CVE-2023-23749/). Rules current as of 14 October 2026.