CVE-2026-102801: Infoleak

Q: Who can trigger the exposure?

An attacker needs the ability to supply content containing Users Anywhere tags with attributes, such as an [email] or [username] tag. The issue affects rendering where those tags are permitted by the applicable content-source policy.

Q: Does disabling email or username output prevent this issue?

No. In affected versions, tag attributes can override the per-render plugin setting, so [email allow_output_email="1"] can display an email address even when email output is configured as disabled.

Q: Are installations protected if Users Anywhere tags are prohibited for the content source?

Yes, this issue does not bypass a separate policy that disallows Users Anywhere tags from that content source. The vulnerable behavior requires the tags to be allowed and rendered.

Q: What version addresses the issue?

The affected range is Users Anywhere for Joomla versions earlier than 3.0.1. Upgrading to 3.0.1 or later removes systems from the stated affected range.

Published Nov 2, 2026

Updated

Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1 - An administrator can disable output of user email addresses or usernames in Users Anywhere. In affected code, attributes supplied inside a {user} or [email] / [username] tag can change those plugin settings for that render. For example, [email allowoutputemail="1"] can display an email address even when Allow output of email is set to No. This bypasses the personal-data output setting; it does not bypass a separate policy that disallows Users Anywhere tags from the content source altogether.

Event History

Nov 2, 2026

CVE Published

via NVD·02:17 PM

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can trigger the exposure?

An attacker needs the ability to supply content containing Users Anywhere tags with attributes, such as an [email] or [username] tag. The issue affects rendering where those tags are permitted by the applicable content-source policy.

Does disabling email or username output prevent this issue?

No. In affected versions, tag attributes can override the per-render plugin setting, so [email allow_output_email="1"] can display an email address even when email output is configured as disabled.

Are installations protected if Users Anywhere tags are prohibited for the content source?

Yes, this issue does not bypass a separate policy that disallows Users Anywhere tags from that content source. The vulnerable behavior requires the tags to be allowed and rendered.

What version addresses the issue?

The affected range is Users Anywhere for Joomla versions earlier than 3.0.1. Upgrading to 3.0.1 or later removes systems from the stated affected range.

CVE-2026-102801: Infoleak

Event History

Frequently Asked Questions

Who can trigger the exposure?

Does disabling email or username output prevent this issue?

Are installations protected if Users Anywhere tags are prohibited for the content source?

What version addresses the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can trigger the exposure?

Does disabling email or username output prevent this issue?

Are installations protected if Users Anywhere tags are prohibited for the content source?

What version addresses the issue?