EUVD-2026-47816Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Requires authenticated user (PR:L), no interaction (UI:N), only confidentiality affected.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
3DescriptionCVE.org
User tags, filters and conditions allowed access to insufficiently restricted user fields. Crafted content could expose authentication-related data, raw user parameters or restricted contact details.
AnalysisAI
Information disclosure in Regular Labs Joomla extensions (Users Anywhere and Articles Anywhere) allows authenticated users to access insufficiently restricted user fields via crafted content containing user tags, filters, or conditions. Attackers with low privileges can expose authentication-related data, raw user parameters, and restricted contact details. No public exploit or active exploitation has been identified at the time of analysis, and the EPSS score (0.23%) indicates low exploitation probability.
Technical ContextAI
The vulnerability resides in the Joomla extensions 'Users Anywhere' (versions 1.0.0-1.2.7) and 'Articles Anywhere' (versions 1.0.0-18.0.2) by Regular Labs. These extensions allow site authors to embed user-specific content using tags, filters, and conditions. The root cause is improper access control (CWE-284): the extensions fail to restrict access to sensitive user fields when processing these tags, permitting any authenticated user (with content creation/edit permissions) to retrieve data such as password hashes, raw parameters, or contact details that should be restricted to administrators. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms a network-accessible, low-complexity attack requiring only low privileges.
RemediationAI
As of the time of analysis, no patched versions have been explicitly identified in the provided data. Administrators should check the official Regular Labs website (https://regularlabs.com/) for security updates or refer to the Joomla security announcements for specific fix versions. Immediate workarounds include restricting content creation privileges to trusted users only, disabling the use of user tags in content (if configuration allows), or implementing a web application firewall (WAF) rule to block suspicious patterns in user tags, filters, or conditions. Note that disabling the extensions entirely will mitigate the vulnerability but may break site functionality that relies on them.
Content tags in the Articles Anywhere and Modules Anywhere extensions for Joomla can ignore access controls, enabling un
Broken CSRF token enforcement across 23 Regular Labs AJAX-based Joomla extensions allows authenticated lower-privileged
Information disclosure in Regular Labs Articles Anywhere and Users Anywhere extensions for Joomla allows unauthenticated
Information disclosure in multiple Regular Labs Joomla extensions allows unauthenticated visitors to retrieve administra
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today