The Users Anywhere extension for Joomla allows administrators to suppress the rendering of user email addresses and usernames. However, a configuration bypass exists whereby attributes supplied inside a {user} tag or an [email] / [username] tag can override these settings. For instance, an attribute such as [email allow_output_email="1"] forces the display of an email address even when the global setting is disabled. This flaw permits an unauthorized actor to access personally identifiable information that the site policy intends to keep private. The weakness is documented as CWE‑200: Information Exposure.

Regularlabs’ Users Anywhere extension for Joomla, both the Free and Pro editions, is vulnerable when installed with a version earlier than 3.0.1. The issue exists on Joomla installations that use these extensions and rely on the extension’s ability to output user data via tags.

The vulnerability carries a CVSS score of 5.1, representing a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. An attacker may exploit the flaw by inserting a tag that supplies the allow_output_* attribute into content that the site accepts from a user, thereby revealing sensitive data. If the site permits unauthenticated users to add or edit tag content, the risk is higher; otherwise, exploitation requires an authenticated account that can place tags. Currently, no public exploits are documented.