GitHub Advisoryadvisory · Maven

GHSA-637h-ch24-xp9m XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService

MEDIUM Published 2026-01-09 Modified 2026-01-11 Official page ↗
Aliases
CVE-2025-65090
Ecosystem
Maven
Packages
org.xwiki.contrib:macro-fullcalendar-pom
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2026-01-09

Affected packages

• Maven org.xwiki.contrib:macro-fullcalendar-pom: < 2.4.6 → fixed in 2.4.6

Description

Impact Anyone who has view rights on the `Calendar.JSONService` page, including guest users can exploit this vulnerability by accessing database info, with the exception of passwords. Workarounds Remove the `Calendar.JSONService` page. This will however break some functionalities. References Jira issue: • FULLCAL-82: Calendar.JSONService exposes emails of all users For more information If you have any questions or comments about this advisory: • Open an issue in Jira XWiki.org • Email us at Security Mailing List

Related

Alias · CVE (1)

  • CVE-2025-65090 XWiki Full Calendar Macro displays objects from the wiki on the calendar. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References