CVE-2026-104054 in cal.diy
Summary
by MITRE • 10/02/2026
A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/02/2026
A critical access control vulnerability has been identified within Cal.com, specifically affecting versions up through 6.2.0 in its cal.diy distribution. This flaw resides within the PBAC Permission Engine component, which is responsible for managing role-based and attribute-based access policies across the platform's scheduling infrastructure. The specific point of failure lies in the doesUserIdHaveAccessToBooking function located in the BookingAccessService.ts file. This module serves as a gatekeeper for determining whether a user possesses the necessary permissions to view or interact with a specific booking record, making it a central component in maintaining data integrity and privacy within the application's multi-tenant architecture.
The technical nature of this vulnerability constitutes an insecure direct object reference combined with broken access control mechanisms. When an attacker manipulates input parameters associated with booking identifiers, the doesUserIdHaveAccessToBooking function fails to properly validate whether the authenticated user is actually authorized to access the targeted resource. Instead of enforcing strict authorization checks based on ownership or assigned roles, the logic allows for unauthorized traversal and retrieval of sensitive scheduling data. This failure in server-side validation means that any authenticated user can potentially bypass intended restrictions by altering request payloads to target bookings they do not own or have permission to view.
From an operational perspective, this vulnerability enables remote attackers to perform missing authorization attacks against other users' calendar events. The impact is severe as it compromises the confidentiality of private scheduling information, including meeting times, participant details, and potentially embedded links or notes within those bookings. Since Cal.com often integrates with various third-party applications and handles sensitive corporate schedules, such a breach can lead to significant privacy violations and potential social engineering opportunities for attackers who gain insight into organizational structures and availability patterns through exposed booking data.
This flaw is classified under CWE-284 Improper Access Control and aligns with the ATT&CK technique T1078 Valid Accounts, as it exploits legitimate authentication credentials to access unauthorized resources. The situation is further exacerbated by the fact that a public exploit has been released, lowering the barrier for entry for less sophisticated threat actors who can leverage existing proof-of-concept code rather than developing custom exploitation methods from scratch. This widespread availability of attack tools increases the likelihood of automated scanning and opportunistic attacks against instances running vulnerable versions.
Mitigation strategies must prioritize immediate remediation through software updates or configuration changes until a formal patch is accepted into the main repository. Administrators should monitor for pull requests addressing this specific issue in BookingAccessService.ts and apply any interim workarounds provided by the development team, such as restricting public access to booking endpoints or implementing additional middleware validation layers that verify ownership before processing requests. Additionally, organizations relying on Cal.com should review their audit logs for unusual patterns of booking data retrieval that do not correspond with expected user activity, which may indicate active exploitation attempts in progress.