Description
A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
Published: 2026-10-02
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Missing authorization for booking access (potential privilege escalation)
Action: Monitor
AI Analysis

Impact

Cal.com cal.diy’s PBAC Permission Engine contains a flaw in the doesUserIdHaveAccessToBooking function of BookingAccessService.ts. An attacker can manipulate the request to bypass authorization checks, allowing them to retrieve or manipulate booking information without appropriate permissions. The vulnerability is an authorization bypass (CWE-862) and a misconfiguration of authorization controls (CWE-863).

Affected Systems

All installations of cal.com cal.diy up to and including version 6.2.0 are affected. The bug resides in the PBAC Permission Engine component. Any user or service that interacts with the BookingAccessService API may be impacted if the application is running a vulnerable version.

Risk and Exploitability

The CVSS score of 5.3 reflects moderate severity, yet the exploit has been publicly released and the attack can be initiated remotely. Since no fix is currently available, the risk is primarily mitigated through constrained access and monitoring rather than remediation. The EPSS score is not available and the vulnerability is not listed in KEV, but the public release of the exploit indicates that attackers can attempt to gain booking‑level privileges until a vendor patch is deployed.

Generated by OpenCVE AI on October 2, 2026 at 03:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a cal.com cal.diy version that includes the fixed PBAC Permission Engine before it is released
  • Implement tighter RBAC on the BookingAccessService interface so that only authorized users can query bookings
  • Enable detailed logging of booking access requests and regularly audit logs for signs of unauthorized activity

Generated by OpenCVE AI on October 2, 2026 at 03:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 02 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 02 Oct 2026 02:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
Title calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization
First Time appeared Calcom
Calcom cal.diy
Weaknesses CWE-862
CWE-863
CPEs cpe:2.3:a:calcom:cal.diy:*:*:*:*:*:*:*:*
Vendors & Products Calcom
Calcom cal.diy
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Calcom Cal.diy
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-02T19:52:48.259Z

Reserved: 2026-10-01T17:57:14.224Z

Link: CVE-2026-104054

cve-icon Vulnrichment

Updated: 2026-10-02T19:52:41.133Z

cve-icon NVD

Status : Deferred

Published: 2026-10-02T02:17:01.740

Modified: 2026-10-02T20:17:00.780

Link: CVE-2026-104054

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T04:00:15Z

Weaknesses