Users Anywhere Free Pro Extension For Joomla
Monthly
The Regular Labs Users Anywhere extension for Joomla (free and Pro) before version 3.0.1 lets a content author override the administrator's personal-data output setting by embedding an attribute inside a {user}, [email] or [username] tag - for example [email allow_output_email="1"] renders an email address even when 'Allow output of email' is set to No. This is a limited information-disclosure issue (CVSS 5.1, CWE-200) that requires authenticated content-authoring access and a site where Users Anywhere tags are permitted in the content source; it does not defeat a separate policy that blocks those tags entirely. No public exploit or PoC reference exists in the available sources and there is no CISA KEV listing or EPSS score, so it is handled on a monthly patch cadence rather than as an emergency.
The Regular Labs Users Anywhere extension for Joomla (free and Pro) before version 3.0.1 lets a content author override the administrator's personal-data output setting by embedding an attribute inside a {user}, [email] or [username] tag - for example [email allow_output_email="1"] renders an email address even when 'Allow output of email' is set to No. This is a limited information-disclosure issue (CVSS 5.1, CWE-200) that requires authenticated content-authoring access and a site where Users Anywhere tags are permitted in the content source; it does not defeat a separate policy that blocks those tags entirely. No public exploit or PoC reference exists in the available sources and there is no CISA KEV listing or EPSS score, so it is handled on a monthly patch cadence rather than as an emergency.