CVE-2025-65090
published 2026-01-10CVE-2025-65090: XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.24%
14.5th percentile
XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users) can exploit the data leak vulnerability by accessing database info, with the exception of passwords. This issue has been patched in version 2.4.6.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| xwiki-contrib | macro-fullcalendar | < 2.4.6 | 2.4.6 |
| xwiki | full_calendar_macro | < 2.4.6 | 2.4.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
ghsa·2026-01-09
CVE-2025-65090 [MEDIUM] CWE-200 XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
### Impact
Anyone who has view rights on the `Calendar.JSONService` page, including guest users can exploit this vulnerability by accessing database info, with the exception of passwords.
### Workarounds
Remove the `Calendar.JSONService` page. This will however break some functionalities.
### References
Jira issue:
* [FULLCAL-82: Calendar.JSONService exposes emails of all users](https://jira.xwiki.org/browse/FULLCAL-82)
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:[email protected])
OSV
XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
osv·2026-01-09
CVE-2025-65090 [MEDIUM] XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
### Impact
Anyone who has view rights on the `Calendar.JSONService` page, including guest users can exploit this vulnerability by accessing database info, with the exception of passwords.
### Workarounds
Remove the `Calendar.JSONService` page. This will however break some functionalities.
### References
Jira issue:
* [FULLCAL-82: Calendar.JSONService exposes emails of all users](https://jira.xwiki.org/browse/FULLCAL-82)
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:[email protected])
No detection rules found.
No public exploits indexed.
2026-01-10
Published