CVE-2026-104054
Deferred Deferred - Pending Action

Missing Authorization in Cal.com Cal.diy PBAC Engine

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: VulDB

Description
A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-104054
EUVD
EUVD-2026-91160

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
calcom cal.diy to 6.2.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a broken access control flaw in the PBAC (Policy-Based Access Control) permission engine of Cal.diy up to version 6.2.0. The system used overly permissive stubs that always returned true for permission checks, allowing any authenticated user to perform unauthorized actions like managing team bookings, accessing recordings, or deleting event types without proper authorization.

Detection Guidance

Check if your Cal.diy instance is running version 6.2.0 or earlier. Inspect the BookingAccessService.ts file for the doesUserIdHaveAccessToBooking function to see if it uses an overly permissive stub that always returns true. Verify if any authenticated user can perform unauthorized actions like modifying team bookings or accessing restricted data.

Impact Analysis

An attacker could exploit this to access sensitive data, modify or delete bookings, or perform actions reserved for team members or administrators. This includes confirming or rejecting team bookings, reading attendee lists, recordings, and transcripts, and changing event types without permission.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control, such as GDPR's principle of least privilege and HIPAA's access controls. Unauthorized access to personal or sensitive data could lead to legal penalties and loss of trust.

Mitigation Strategies

Upgrade Cal.diy to a version that includes the fix for CVE-2026-104054. Replace the stub PermissionCheckService with the real membership-based service. Ensure permission checks enforce proper access controls and test the changes thoroughly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104054. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart