# CVE-2026-102801: Regular Labs Users Anywhere information disclosure via tag attributes

Source: https://junglewise.ai/threats/cve-2026-102801-joomla-extension-regularlabs-com-exposure-of-sensitive  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-02. Updated: 2026-11-02  
License: CC BY 4.0 with a link back

CVE-2026-102801 · Severity: info · Published 2026-11-02

Users Anywhere is a Joomla extension that places user information on websites. An administrator can restrict display of email addresses or usernames to protect user privacy, but this restriction can be bypassed by embedding override attributes in content tags, allowing unauthorized disclosure of sensitive user data that should be hidden.

Technologies: [Regular Labs Users Anywhere](https://junglewise.ai/threats/technologies/users-anywhere). Vendors: [Regular Labs](https://junglewise.ai/threats/vendors/regular-labs).

## Quick answers

**Is CVE-2026-102801 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102801 being exploited in the wild.

**How severe is CVE-2026-102801?** Informational severity, published 2 November 2026.

**Which products and versions are affected?** Regular Labs Users Anywhere before 3.0.1.

**Is there a fix for CVE-2026-102801?** Yes: fixed in 3.0.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102801 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-102801?** Check whether you run Regular Labs Users Anywhere at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.0.1

## Technical details

The Users Anywhere plugin fails to properly validate tag attributes, allowing tag-level attributes like allow_output_email="1" to override global administrator settings that restrict personal data output. An attacker with the ability to edit content can bypass privacy restrictions by injecting these attributes into {user}, [email], or [username] tags, though note this does not bypass policies that completely disallow Users Anywhere tags from a content source.

## Affected products

- Regular Labs Users Anywhere before 3.0.1

## Timeline

- 2026-11-02: disclosed

## References

- [https://www.regularlabs.com/](https://www.regularlabs.com/)

## Related threats

- [Regular Labs Articles Anywhere and Users Anywhere reflected XSS](https://junglewise.ai/threats/cve-2026-85196-regular-labs-articles-anywhere-and-users-anywhere-reflected-xss)
- [Regular Labs Joomla extensions information exposure via improper caching](https://junglewise.ai/threats/cve-2026-65755-regular-labs-joomla-extensions-information-exposure-via-improper)
- [Regular Labs Joomla Extensions improper access control in user fields](https://junglewise.ai/threats/cve-2026-64794-regular-labs-joomla-extensions-improper-access-control-in-user)