CVE-2025-65090: 
Java vulnerability analysis and mitigation

CVE-2025-65090 is a data leak vulnerability in the XWiki Full Calendar Macro (org.xwiki.contrib:macro-fullcalendar-pom) that allows unauthorized access to database information through the Calendar.JSONService page. Any user with view rights to that page — including unauthenticated guest users — can exploit this flaw to retrieve sensitive wiki database contents, excluding passwords. All versions up to and including 2.4.5 are affected; the issue was disclosed on January 9, 2026, and patched in version 2.4.6. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory).

The root cause is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The Calendar.JSONService page in the Full Calendar Macro extension improperly exposes database query results — including user email addresses and other object data — without enforcing adequate access controls, making the data accessible to anyone who can view the page, including guests. The fix, applied in commit 25bc14c, adds property existence checks and restricts what data the service returns (Github Advisory, Patch Commit).

Successful exploitation results in unauthorized disclosure of wiki database information, specifically confirmed to include user email addresses and other stored object properties, while passwords are explicitly excluded from the leak. The impact is limited to confidentiality — there is no integrity or availability impact. On wikis with guest access enabled, this vulnerability is exploitable without any authentication, potentially exposing personally identifiable information (PII) of all registered users to anonymous actors (Github Advisory).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-65090. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.033% (10th percentile), indicating a low probability of exploitation in the near term (Github Advisory).

1. Reconnaissance: Identify XWiki instances running the Full Calendar Macro extension (versions ≤ 2.4.5) that are publicly accessible or allow guest access.
2. Access the vulnerable endpoint: Navigate directly to the Calendar.JSONService page on the target XWiki instance (e.g., https://<xwiki-host>/xwiki/bin/view/Calendar/JSONService) without any authentication.
3. Retrieve database information: The service responds with JSON-formatted data containing wiki object properties, including user email addresses and other stored database fields.
4. Harvest sensitive data: Parse the JSON response to extract user emails and other exposed object data for reconnaissance or further targeted attacks (Github Advisory).

• Network: Unusual or repeated unauthenticated HTTP GET requests to /xwiki/bin/view/Calendar/JSONService or equivalent paths from external or unexpected IP addresses.
• Logs: XWiki access logs showing guest or anonymous user sessions accessing the Calendar.JSONService page, particularly in high volume or from automated tools (e.g., consistent user-agent strings, rapid sequential requests).
• Logs: Absence of authentication tokens in requests to the JSONService endpoint combined with successful HTTP 200 responses.

Upgrade the XWiki Full Calendar Macro to version 2.4.6 or later, which contains the security fix. As a temporary workaround, administrators can remove the Calendar.JSONService page from the wiki; note that this will break some calendar functionalities that depend on the service. Administrators should also review XWiki guest access settings and restrict anonymous view permissions where possible (Github Advisory, Patch Commit).