JoomProject 1.1.3.2, a component for the Joomla content management system, has a flaw in its projects endpoint that leaks sensitive user data. The vulnerability allows attackers without any authentication to send a crafted request to index.php with certain query parameters, causing the component to return a JSON object that contains user IDs, names, and email addresses. This weakness is classified as CWE‑359, which denotes information disclosure due to improper access controls.

The affected product is the JoomProject component for Joomla, version 1.1.3.2, released by Joomboost. No other Joomla add‑ons or core versions are listed as affected; however, any Joomla site that has this component installed and unchanged could be compromised.

The flaw carries a CVSS score of 8.7, indicating high severity. EPSS is not available, so the exact likelihood of exploitation is uncertain, but the lack of authentication requirements makes the attack vector straightforward for network‑based attackers. The flaw is not currently catalogued in the CISA KEV list, yet the ability to freely pull user credentials from any public Joomla installation still poses a significant risk to sites that rely on the component for project management.