Vulnerability · Published Oct 2, 2026 · Assigned by VulDB

CVE-2026-104054calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

Medium 6.3

In plain English

A medium-severity missing authorization in cal.diy from calcom. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.2%top 88.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

Affected products (as reported)

Vendor	Product	Versions
calcom	cal.diy	6.06.16.2.0

Weakness: CWE-862, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-412762 | calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization vdb-entry, technical-description
VDB-412762 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-104054 | CVE Analysis and Report third-party-advisory
Submit #959492 | https://github.com/calcom/ cal.diy commit 4026669 broken access control third-party-advisory
https://github.com/calcom/cal.diy/issues/29802 exploit, issue-tracking
https://github.com/calcom/cal.diy/pull/30253 issue-tracking, patch
https://github.com/calcom/cal.diy/ product