Users Anywhere CVE-2026-102801

Exploitation requires the ability to place Users Anywhere tags ({user}, [email], [username]) into a content source that the extension renders, and then to add an overriding attribute such as allow_output_email="1" (or the username equivalent). That attribute changes the plugin's personal-data output setting for that single render, bypassing an administrator's 'Allow output of email/username = No' configuration. A key limiting factor stated by the vendor: this does NOT bypass the separate policy that disallows Users Anywhere tags from the content source altogether - if that policy blocks the tags, the override cannot be reached. Exploitation therefore depends on (a) authenticated content-authoring access and (b) a configuration where Users Anywhere tags are permitted in the content source; it also only matters where an admin has deliberately disabled email/username output.

This is a moderate-severity information-disclosure issue (CVSS 5.1, CWE-200) with no signals of real-world exploitation: no CISA KEV listing, no EPSS score supplied, and no public exploit or PoC reference in the input (the only reference is the vendor homepage, not an advisory). The vuln.today decision label is 'this_month', consistent with a prioritize-but-not-emergency posture rather than act_now. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N) describes network reach and low complexity but requires privileges (PR:H) and yields only low confidentiality impact with no integrity or availability effect - matching the description, where the abuse is performed by someone who can author content containing Users Anywhere tags. The practical risk is bounded: it exposes user email addresses/usernames that an administrator intended to suppress, not credentials or system control. The one tension worth flagging is privilege level: the input scores PR:H, but the described capability (embedding [email]/[username]/{user} tags in a content source) is typically a content-author function in Joomla rather than full administrative access - see assessed vector below, where PR:L is argued. This is a genuine but contained personal-data exposure issue, not a high-urgency remote-compromise threat.

A user with content-authoring access on a Joomla site running Users Anywhere < 3.0.1 inserts a tag such as [email allow_output_email="1"] into a page or article. At render time the attribute overrides the administrator's 'Allow output of email = No' setting, causing a user's protected email address (or username) to be displayed to viewers even though personal-data output was disabled. No public exploit identified at time of analysis; the trigger is the per-tag attribute described by the vendor.