Login With Keycloak Oauth Single Sign On Sso Login With Keycloak Free Extension For Joomla
Monthly
Unauthenticated extension deletion is possible across at least 24 free miniOrange plugin packages for Joomla due to a missing authentication check on extension management functionality. Any network-accessible attacker with no credentials and no user interaction can remove arbitrary installed Joomla extensions, including security-critical ones such as JoomShield or authentication plugins. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial remote exploitation with zero preconditions.
Unauthenticated extension deletion is possible across at least 24 free miniOrange plugin packages for Joomla due to a missing authentication check on extension management functionality. Any network-accessible attacker with no credentials and no user interaction can remove arbitrary installed Joomla extensions, including security-critical ones such as JoomShield or authentication plugins. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial remote exploitation with zero preconditions.