CVE-2025-65090: org.xwiki.contrib:macro-fullcalendar-pom Vulnerable to Data Leak via Calendar.JSONService
Summary
CVE-2025-65090: XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService. Affects org.xwiki.contrib:macro-fullcalendar-pom versions < 2.4.6. Fixed in 2.4.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'org.xwiki.contrib:macro-fullcalendar-pom' package is a component of XWiki that provides a full calendar macro for displaying events and schedules. This package is widely used in XWiki applications to enhance user interaction with calendar functionalities. However, it has a vulnerability that allows unauthorized access to sensitive database information through the Calendar.JSONService page.
Vulnerability Detail
The vulnerability arises from improper access controls on the Calendar.JSONService page, which exposes sensitive user data, including emails, to anyone with view rights, including guest users. This could lead to unauthorized data access and potential privacy violations, as attackers can exploit this flaw to gather information about users without needing authentication. The vulnerability is classified under CWE-200, indicating an exposure of sensitive information.
How To Fix
Minimum fixed version
2.4.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can remove the Calendar.JSONService page. However, be aware that this will break some functionalities of the calendar feature within your application.
Conclusion
In summary, the vulnerability CVE-2025-65090 in the org.xwiki.contrib:macro-fullcalendar-pom package poses a risk of data leakage through the Calendar.JSONService page. It is crucial to update to the patched version 2.4.6 or later to mitigate this risk. Users should also consider temporary workarounds if immediate updates are not feasible.
See every vulnerability recorded for org.xwiki.contrib:macro-fullcalendar-pom →
FAQ
The vulnerability allows unauthorized users to access sensitive information, such as user emails, which can lead to privacy breaches.
Any user with view rights on the Calendar.JSONService page, including guest users, is potentially affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider removing the Calendar.JSONService page as a temporary workaround.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.xwiki.contrib:macro-fullcalendar-pom.
