TI-2026-83807 Aliases CVE-2026-102801 GHSA-4v98-4xvq-p4hv

Users Anywhere for Joomla exposes emails despite output setting

LOW 24CWE-200Published 2026-11-02 · Updated 2026-11-02

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

The Users Anywhere (Free, Pro) extension for Joomla by regularlabs.com, versions from 1.0.0-3.0.0, is affected. Attributes inside a {user}, [email] or [username] tag can override the plugin setting that disables output of email addresses or usernames, which exposes sensitive information (CWE-200). An administrator with high privileges can trigger this over the network without user interaction to display personal data that the output setting should hide. The override does not bypass a separate policy that disallows Users Anywhere tags from the content source.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1 - An administrator can disable output of user email addresses or usernames in Users Anywhere. In affected code, attributes supplied inside a {user} or [email] / [username] tag can change those plugin settings for that render. For example, [email allow_output_email="1"] can display an email address even when Allow output of email is set to No. This bypasses the personal-data output setting; it does not bypass a separate policy that disallows Users Anywhere tags from the content source altogether.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00435 37th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
regularlabs.com	Users Anywhere (Free, Pro) extension for Joomla	1.0.0-3.0.0	—	No fix listed	CNA

Users Anywhere (Free, Pro) extension for Joomla Vendorregularlabs.com Affected 1.0.0-3.0.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Users Anywhere (Free, Pro) extension for Joomla.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Timeline

2026-11-02 Threatist record created from CVE-2026-102801
2026-11-02 Alias added: GHSA-4v98-4xvq-p4hv
2026-11-02 CISA SSVC decision points changed

References

Other 1

https://www.regularlabs.com/

TI-2026-46603 Path traversal in regularlabs.com GeoIP extension for Joomla CVSS 3.1CRITICAL 9.8
TI-2025-16115 Extension - regularlabs.com - Remote code execution vulnerability in the Sourcerer extensions < 12.0.0 for Joomla CVSS 3.1CRITICAL 9.8
TI-2026-52038 Code injection in regularlabs.com Sourcerer extension for Joomla CVSS 4.0CRITICAL 10.0
TI-2026-46380 Information disclosure in regularlabs.com Cache Cleaner Pro extension for Joomla CVSS 3.1CRITICAL 9.8
TI-2026-46379 Server-side request forgery in regularlabs.com Cache Cleaner Pro extension for Joomla CVSS 3.1CRITICAL 9.8
TI-2026-46326 Improper access control in regularlabs.com Sourcerer extension for Joomla CVSS 3.1CRITICAL 9.8

See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences