miniOrange Extensions for Joomla: Security Vulnerability Fix (CVE-2026-78074)

1. Summary

• CVE ID = CVE-2026-78074

• Vulnerability Type = Improper Access Control (CWE-284)

• Affected Versions = All versions before fixed releases (Only Free versions affected)

• Fixed Version = See Fixed Versions list below

2. Overview

A high-severity vulnerability was found in 23 miniOrange Joomla extensions that allows an unauthenticated remote attacker to delete arbitrary installed extensions on an affected site without valid credentials. It affects all free versions before the patched releases. Sites running an older version should update immediately.

3. Technical Details

Root cause: The affected extensions lack proper authentication and authorization checks in the deactivation-feedback handler, allowing unauthenticated requests to execute the extension deinstallation routine.

Attack vector: The vulnerability can be exploited remotely over the network. It requires no valid credentials, low attack complexity, and no interaction from the targeted user or administrator; an attacker only needs to send a request invoking the deinstallation routine.

Impact: Exploiting this issue enables attackers to remove arbitrary installed Joomla extensions, including critical security or authentication components, causing site disruption and weakening site defenses.

4. Fixed Versions

Free editions of the following miniOrange Joomla extensions:

5. Vulnerability Resolution

In the patched versions, the deactivation-feedback handler no longer performs extension uninstallation for unauthenticated requests. The execution path is now strictly restricted to the administrator application, requires an authenticated user holding the 'core.manage' permission for com_installer, is protected by a Joomla CSRF token, and will only act upon extension IDs belonging to the miniOrange package itself while ignoring attacker-supplied extension IDs.

6. Remediation Steps

1. Log in to the miniOrange portal using this link: https://portal.miniorange.com/ (with the same credentials used to procure the licence).

2. Navigate to the Downloads section from the left vertical menu bar.

3. Download the latest version of the applicable extension(s).

4. Update the installed miniOrange extension(s) for Joomla to the patched version listed above or later.

5. After updating, confirm the extension is running the patched version or later.