Medium severity · published Oct 2, 2026
CVE-2026-104054
calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization
6.3
CVSS
0.2%
EPSS
No
On KEV
Description
A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
cal.diy · calcom
6.0; 6.1; 6.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-104054
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-104054
vdb-entry
https://vuldb.com/vuln/412762
signature
https://vuldb.com/vuln/412762/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-104054
third-party-advisory
https://vuldb.com/submit/959492
exploit
https://github.com/calcom/cal.diy/issues/29802
issue-tracking
https://github.com/calcom/cal.diy/pull/30253
More from cal.diy
10.0
CVE-2025-71389
Cal.com before 5.9.9 Remote Code Execution via RSC
9.9
CVE-2024-58354
cal.com Repository Takeover via pull_request_target Workflow
8.9
CVE-2024-58355
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
8.9
CVE-2024-58353
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
6.3
CVE-2026-112043
calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization