Hi, I've got the same problem. So, is it not save to update to Joomla! 3.6.4?

You should update your Joomla installation to version 3.6.4 immediately! It is a security fix, that repairs a very critical issue: A hacker can create accounts with administrator privileges, even when you have disabled log in or the creation of accounts! All Joomla installations from V 3.4 are affected from this issue.
So to stay on an old version means you give up your website.

It is important to see what the JASON error causes: Its not the update itself. In the update of Joomla the developers built in a check, whether JASON decoded parameters are presented correctly or not. In case if not, it throws the error we are talking about. The problem is, that those incorrect parameters were written into the database a long time ago by components or plugins. Sometimes this may have been done also during the creation of a website by using a copying routine. In dont know what exactly it was. In my case the Jason error was caused by those mess of /// and .... and """ in the params column of the user table. I have been using Community Builder for a long time and the params therefore have been written only by CB. Maybe that a malicious peace of code in Joomla did the rest, but the result was a chaotic string in the params column. In case you dont want to review every single line manually and correct this into a correct string readable for the JASON routine, then just use this mysql Statement to let your server do the work:

UPDATE `XXXX_users` SET `params` = '{}'.

Please note: XXXX has to be replaced by your database-prefix, that your Joomla uses in your MYSQL database.

Keep in mind, what Krileon said above: This will reset ALL user parameters to default state.

Its up to you, what you prefer to do. But YOU HAVE TO DO IT. if you dont want to present your website to hackers as a nice peace of cake.

Best regards
Tom

krileon wrote: We don't use Joomlas object classes so we never call stringToObject, which appears to be the problem. Most likely it's in Joomlas user object or some sort of loading behavior for a system plugin or modules parameters. In short it's a problem in Joomlas own database tables. Probably the easiest way to fix it is manually review the _modules and _extensions database tables then ensure the params columns have valid json.

In my case, user list are failing..

I get the Error decoding JSON data: Syntax error after upgrading.. corrected a user list with an advance filter where fieldname = '' previously i just left the fieldname "equal to" blank (leaving the field empty at basic mode) bu by adding the = ' ' it corrected the issue..

I have another problem where I had another filter where cb_completedby equal to [cb:userdata field="email" user="#me" /]

It seems that CB substitution cant work.. be cause of the / in the [cb:userdata field="email" user="#me" /]

UPDATE `XXXX_users` SET `params` = '{}'.

Please note: XXXX has to be replaced by your database-prefix, that your Joomla uses in your MYSQL database.

Keep in mind, what Krileon said above: This will reset ALL user parameters to default state.

This worked! Thanks man.. Somehow the params column is screwing everything on CB.. after setting everything to '{}', everything worked!

For those who are comfortable in setting params` = '{}', copy the table first..

I have an odd variant of this problem.
I'm using the current Joomla/CB/CBSubs.

I was able to tick two subscription plan items in a users subscription details on the CB User Management Edit screen. Something like Delete and Unsubscribe (I can't remember exactly) on two different subscriptions. I then saved and got the error being discussed in this topic. All attempts to edit that member resulted in the same error, but other members were unaffected.

Having read this thread, I replaced the contents of params for this member (only) with {} and all is now well. The stuff I replaced had no closing bracket, but a lot of slashes, etc. What was not clear to me from this thread was whether the contents of params was important or not, so I was reluctant to clear them all, but as my problem was just the one member (which I could list but not edit nor delete) I took the risk and all seems fine.

Thought it might be useful to others and also to Krileon as regards the cause of the problem.
Thanks