What is GHSA-637h-ch24-xp9m?

GHSA-637h-ch24-xp9m is a security advisory published by GitHub Security Advisories with Medium severity. XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService

Which CVE IDs does GHSA-637h-ch24-xp9m cover?

GHSA-637h-ch24-xp9m covers the following CVE IDs: CVE-2025-65090. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-637h-ch24-xp9m?

GHSA-637h-ch24-xp9m has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-637h-ch24-xp9m?

GHSA-637h-ch24-xp9m affects 1 product, including: maven/org.xwiki.contrib:macro-fullcalendar-pom:\u003c= 2.4.5.

GHSA-637h-ch24-xp9mMediumCVSS 5.3

XWiki Full Calendar Macro vulnerable to data leak through Calendar.JSONService

Vendor

GitHub Security Advisories

Published

January 9, 2026

Last Modified

January 11, 2026

🔗 CVE IDs covered (1)

CVE-2025-65090 →

📋 Description

Impact

Anyone who has view rights on the Calendar.JSONService page, including guest users can exploit this vulnerability by accessing database info, with the exception of passwords.

Workarounds

Remove the Calendar.JSONService page. This will however break some functionalities.

References

Jira issue:

FULLCAL-82: Calendar.JSONService exposes emails of all users

For more information

If you have any questions or comments about this advisory:

Open an issue in Jira XWiki.org
Email us at Security Mailing List

🎯 Affected products1

maven/org.xwiki.contrib:macro-fullcalendar-pom:<= 2.4.5

🔗 References (5)

https://github.com/xwiki-contrib/macro-fullcalendar/security/advisories/GHSA-637h-ch24-xp9m
https://github.com/xwiki-contrib/macro-fullcalendar/commit/25bc14c181c9a92f493b20ac264388c7ba171884
https://jira.xwiki.org/browse/FULLCAL-82
https://nvd.nist.gov/vuln/detail/CVE-2025-65090
https://github.com/advisories/GHSA-637h-ch24-xp9m