{"id":"CVE-2026-102801","title":"Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1","summary":"Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1 - An administrator can disable output of user email addresses or usernames in Users Anywhere. In …","severity":"medium","cvss":5.1,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-200"],"vendor":"regularlabs.com","product":"plg_system_usersanywhere","affected":["plg_system_usersanywhere 1.0.0-3.0.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-02T16:52:41.906234Z"},"published":"2026-11-02","updated":"2026-11-02","sourceUpdated":"2026-11-02T18:51:59.416Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102801","references":[{"url":"https://www.regularlabs.com/"}],"tags":["cve.org"],"epss":0.00435,"epssPercentile":0.37968,"ingestedAt":"2026-11-05T19:30:42.777Z","slug":"CVE-2026-102801","body":"## Overview\n\nJoomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1 - An administrator can disable output of user email addresses or usernames in Users Anywhere. In affected code, attributes supplied inside a {user} or [email] / [username] tag can change those plugin settings for that render. For example, [email allow_output_email=\"1\"] can display an email address even when Allow output of email is set to No. This bypasses the personal-data output setting; it does not bypass a separate policy that disallows Users Anywhere tags from the content source altogether.\n\n## Affected\n\n- `plg_system_usersanywhere 1.0.0-3.0.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":28.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}