Live › vulnerability › CVE-2026-102801
The Users Anywhere extension for Joomla lets attributes in user tags override the administrator setting that hides user email addresses and usernames. An attacker who can write or view content using those tags can display personal data the site was configured to hide.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 14:23 UTC. All times on this page are UTC.
Sites running the Users Anywhere extension for Joomla below 3.0.1 that use its user tags in content. The bypass only applies when the site's email or username output is disabled and the tags are not blocked by a separate policy. Sites without this extension can skip it.
No product ranges from the sources yet.
3.0.1 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1 - An administrator can disable output of user email addresses or usernames in Users Anywhere. In affected code, attributes supplied inside a {user} or [email] / [username] tag can change those plugin settings for that render. For example, [email allow_output_email="1"] can display an email address even when Allow output of email is set to No. This bypasses the personal-data output setting; it does not bypass a separate policy that disallows Users Anywhere tags from the content source altogether.
This page as .md · .json · in your agent: get_signal("CVE-2026-102801")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.