---
id: "CVE-2026-102801"
kind: "vulnerability"
aliases: ["CVE-2026-102801"]
title: "Joomla Users Anywhere: content tags can override email and username privacy settings"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["joomla", "package", "regularlabs", "self-hosted", "users-anywhere"]
not_affected_if: ["extension-not-installed", "tags-disallowed-by-policy", "version-3.0.1-or-later"]
published_at: "2026-11-02T14:17:32+00:00"
first_seen_at: "2026-11-02T14:23:23+00:00"
updated_at: "2026-11-02T14:24:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102801", "first_seen_at": "2026-11-02T14:23:23+00:00"}]
---

# Joomla Users Anywhere: content tags can override email and username privacy settings

The Users Anywhere extension for Joomla lets attributes in user tags override the administrator setting that hides user email addresses and usernames. An attacker who can write or view content using those tags can display personal data the site was configured to hide.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Users Anywhere extension version in the Joomla administrator under Extensions > Manage
- Confirm whether the extension is installed at all; unknown whether other checks are needed

## Fix

- Joomla Users Anywhere extension: move to `3.0.1` or later

## Timeline

- 2026-11-02T14:23:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102801

## From the sources

Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1 - An administrator can disable output of user email addresses or usernames in Users Anywhere. In affected code, attributes supplied inside a {user} or [email] / [username] tag can change those plugin settings for that render. For example, [email allow_output_email="1"] can display an email address even when Allow output of email is set to No. This bypasses the personal-data output setting; it does not bypass a separate policy that disallows Users Anywhere tags from the content source altogether.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_