Listen to this Post
The vulnerability in XWiki Full Calendar Macro stems from the Calendar.JSONService page, which is exposed to users with view rights, including guest accounts. This service handles JSON requests for calendar data but lacks proper authorization checks. When accessed, it directly queries the database and returns sensitive information, such as user details and application data, in JSON format. The issue arises because the service does not validate user permissions before executing database queries. Although passwords are not disclosed due to hashing or exclusion, other confidential data is leaked. Attackers can exploit this by simply navigating to the service URL via HTTP requests, like GET calls, allowing unauthorized data retrieval. The vulnerability is present due to insufficient access controls on the endpoint, treating view rights as sufficient for data access. This exposes the database to information disclosure attacks. The flaw is fixed in version 2.4.6 by implementing access validation to restrict service usage to authorized users only.
Platform: XWiki Calendar Macro
Version: <= 2.4.5
Vulnerability: Data leak vulnerability
Severity: Moderate
date: Jan 9 2026
Prediction: Patch released 2.4.6
What Undercode Say:
Analytics
curl -v target/Calendar.JSONService
grep database_info response.json
rm Calendar.JSONService page
How Exploit:
Access service URL
View database information
Exploit guest access
Protection from this CVE
Update to 2.4.6
Remove service page
Restrict view rights
Impact:
Data confidentiality compromised
Information disclosure risk
Moderate severity impact
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
