GHSA-637h-ch24-xp9m

Source

https://github.com/advisories/GHSA-637h-ch24-xp9m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-637h-ch24-xp9m/GHSA-637h-ch24-xp9m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-637h-ch24-xp9m

Aliases

CVE-2025-65090

Published

2026-01-09T18:35:57Z

Modified

2026-02-03T03:03:41Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService

Details

Impact

Anyone who has view rights on the Calendar.JSONService page, including guest users can exploit this vulnerability by accessing database info, with the exception of passwords.

Workarounds

Remove the Calendar.JSONService page. This will however break some functionalities.

References

Jira issue:

FULLCAL-82: Calendar.JSONService exposes emails of all users

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

Database specific

{
    "cwe_ids": [
        "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-09T18:35:57Z",
    "nvd_published_at": "2026-01-10T04:16:01Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven / org.xwiki.contrib:macro-fullcalendar-pom

Package

Name: org.xwiki.contrib:macro-fullcalendar-pom; View open source insights on deps.dev
Purl: pkg:maven/org.xwiki.contrib/macro-fullcalendar-pom

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.4.6

Database specific

last_known_affected_version_range

"<= 2.4.5"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-637h-ch24-xp9m/GHSA-637h-ch24-xp9m.json"