{"id":"CVE-2026-102801","kind":"vulnerability","aliases":["CVE-2026-102801"],"related":[],"title":"Joomla Users Anywhere: content tags can override email and username privacy settings","description":"Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1 - An administrator can disable output of user email addresses or usernames in Users Anywhere. In affected code, attributes supplied inside a {user} or [email] / [username] tag can change those plugin settings for that render. For example, [email allow_output_email=\"1\"] can display an email address even when Allow output of email is set to No. This bypasses the personal-data output setting; it does not bypass a separate policy that disallows Users Anywhere tags from the content source altogether.","summary":"The Users Anywhere extension for Joomla lets attributes in user tags override the administrator setting that hides user email addresses and usernames. An attacker who can write or view content using those tags can display personal data the site was configured to hide.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["joomla","package","regularlabs","self-hosted","users-anywhere"],"not_affected_if":["extension-not-installed","tags-disallowed-by-policy","version-3.0.1-or-later"],"how_to_check":"- Check the installed Users Anywhere extension version in the Joomla administrator under Extensions > Manage\n- Confirm whether the extension is installed at all; unknown whether other checks are needed","fix":"- Joomla Users Anywhere extension: move to `3.0.1` or later","status":"open","published_at":"2026-11-02T14:17:32+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","triaged_at":"2026-11-02T14:24:54+00:00","updated_at":"2026-11-02T14:24:54+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T14:24:54Z","model":"claude-haiku-5-5","output":{"fix":"- Joomla Users Anywhere extension: move to `3.0.1` or later","reach":"internet","title":"Joomla Users Anywhere: content tags can override email and username privacy settings","impact":"low","summary":"The Users Anywhere extension for Joomla lets attributes in user tags override the administrator setting that hides user email addresses and usernames. An attacker who can write or view content using those tags can display personal data the site was configured to hide.","audience":"businesses","category":"package","nicknames":[],"who_cares":["joomla","users-anywhere","regularlabs","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"personal email addresses and usernames displayed despite privacy settings","analyst_note":"","how_to_check":"- Check the installed Users Anywhere extension version in the Joomla administrator under Extensions > Manage\n- Confirm whether the extension is installed at all; unknown whether other checks are needed","plain_action":"","needs_analyst":false,"not_affected_if":["extension-not-installed","version-3.0.1-or-later","tags-disallowed-by-policy"],"who_is_affected":"Sites running the Users Anywhere extension for Joomla below 3.0.1 that use its user tags in content. The bypass only applies when the site's email or username output is disabled and the tags are not blocked by a separate policy. Sites without this extension can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":4242,"output_tokens":525,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102801':15A,18A '-2026':14A,17A '1':128C '3.0.1':87C 'actor':80C 'address':47B,96C,133C 'administr':41B,89C 'affect':103C 'allow':125C,136C 'altogeth':168C 'anywher':3A,27B,30B,83C,101C,162C 'attack':51B 'attribut':35B,105C 'bypass':145C,155C 'chang':115C 'code':104C 'configur':68B 'content':4A,57B,166C 'cve':13A,16A 'data':64B,149C 'disabl':91C 'disallow':160C 'display':62B,130C 'email':8A,46B,95C,111C,124C,127C,132C,139C 'even':134C 'exampl':123C 'exposur':74C 'extens':31B,72C,84C 'hide':44B,70B 'host':24B 'inform':77C 'insid':107C 'joomla':1A,19B,33B,71C,86C 'let':34B 'output':92C,126C,137C,150C 'overrid':7A,39B 'packag':20B 'person':63B,148C 'personal-data':147C 'plugin':117C 'polici':158C 'privaci':11A 'regularlab':21B 'regularlabs.com':73C 'render':121C 'self':23B 'self-host':22B 'sensit':76C 'separ':157C 'set':12A,42B,118C,141C,151C 'site':66B 'sourc':167C 'suppli':106C 'tag':5A,38B,60B,113C,163C 'unauthor':79C 'use':58B 'user':2A,26B,29B,37B,45B,82C,94C,100C,109C,161C 'usernam':10A,49B,98C,112C 'users-anywher':25B 'view':56B 'write':54B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Users Anywhere extension for Joomla below 3.0.1 that use its user tags in content. The bypass only applies when the site's email or username output is disabled and the tags are not blocked by a separate policy. Sites without this extension can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["joomla","medium","package","regularlabs","selfhosted","usersanywhere"],"first_public_at":"2026-11-02T14:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102801","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102801","severity":null,"published_at":"2026-11-02T14:17:32+00:00","modified_at":"2026-11-02T14:17:32+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","fetched_at":"2026-11-02T14:23:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}