CVE-2025-65090 PUBLISHED

XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService

Assigner: GitHub_M
Reserved: 17.11.2025 Published: 10.01.2026 Updated: 12.01.2026

XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users) can exploit the data leak vulnerability by accessing database info, with the exception of passwords. This issue has been patched in version 2.4.6.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	xwiki-contrib
Product	macro-fullcalendar
Versions	Version < 2.4.6 is affected

References

https://github.com/xwiki-contrib/macro-fullcalendar/security/advisories/GHSA-637h-ch24-xp9m
https://github.com/xwiki-contrib/macro-fullcalendar/commit/25bc14c181c9a92f493b20ac264388c7ba171884
https://jira.xwiki.org/browse/FULLCAL-82

Problem Types

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE