CVE-2026-104054
MediumCVSS 6.3Summary
A security flaw has been discovered in calcom cal.diy up to 6.2.0. It affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used. The pull request to fix this issue awaits acceptance.
Risk Assessment
The risk includes unauthorized access to booking functionality, potentially leading to data breach or unauthorized actions.
Recommendation
Monitor the status of the fix and deploy it promptly, and temporarily restrict access to the system.
Other vulnerabilities in calcom cal.diy
See all- CVE-2026-9349Medium
Vulnerability in calcom cal.diy up to version 4.9.4. The getServerSideProps function in apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the Generic React API component causes information disclosure via manipulation of cancelledBy/rescheduledBy arguments. The attack can be initiated remotely and the exploit is publicly available.
- CVE-2026-9303Medium
A CSRF vulnerability has been identified in calcom cal.diy up to version 4.9.4. An unknown function allows CSRF attacks that can be initiated remotely. The exploit is publicly available. The vendor did not respond.
Original NVD description (English source)
A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS