CVE-2025-65090: XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService
Impact Anyone who has view rights on the Calendar.JSONService page, including guest users can exploit this vulnerability by accessing database info, with the exception of passwords.
Workarounds Remove the Calendar.JSONService page. This will however break some functionalities.
References
Jira issue: FULLCAL-82: Calendar.JSONService exposes emails of all users
For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Other sources
XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users) can exploit the data leak vulnerability by accessing database info, with the exception of passwords. This issue has been patched in version 2.4.6.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65090?
CVE-2025-65090 is a vulnerability that allows unauthorized access to sensitive database information for users with view rights on the Calendar.JSONService page.
How do I fix CVE-2025-65090?
To resolve CVE-2025-65090, you should remove the Calendar.JSONService page, but be aware this may break some functionalities.
Who is affected by CVE-2025-65090?
CVE-2025-65090 affects users with view rights, including guest users, who can exploit the vulnerability.
What information can be accessed through CVE-2025-65090?
CVE-2025-65090 allows access to database information, excluding passwords.
What versions of the software are vulnerable to CVE-2025-65090?
CVE-2025-65090 affects versions of the org.xwiki.contrib:macro-fullcalendar-pom package up to version 2.4.5.