Sensitive Information Exposure in Users Anywhere Extension for Joomla by Regular Labs

CVE-2026-102801

What is CVE-2026-102801?

The Users Anywhere extension for Joomla by Regular Labs is vulnerable to sensitive information exposure, which could allow unauthorized actors to access user email addresses or usernames. Despite administrator settings disabling the output of these details, the vulnerability arises when the attributes supplied within {user} or [email] / [username] tags can unintentionally circumvent those restrictions. For instance, using the tag [email allow_output_email="1"] can display an email address even if the output is set to 'No'. This flaw can compromise the personal data output settings, while it remains bound by other policies avoiding the use of Users Anywhere tags from the content source entirely.

References