calcom cal.diy vulnerabilities

A security flaw has been discovered in calcom cal.diy up to 6.2.0. It affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used. The pull request to fix this issue awaits acceptance.

Vulnerability in calcom cal.diy up to version 4.9.4. The getServerSideProps function in apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the Generic React API component causes information disclosure via manipulation of cancelledBy/rescheduledBy arguments. The attack can be initiated remotely and the exploit is publicly available.

A CSRF vulnerability has been identified in calcom cal.diy up to version 4.9.4. An unknown function allows CSRF attacks that can be initiated remotely. The exploit is publicly available. The vendor did not respond.