CVE-2026-104054: calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization
A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs low-level privileges and can initiate the attack remotely over the network. No user interaction is required.
Which deployments are affected?
Cal.com cal.diy versions up to 6.2.0 are identified as affected. The issue is in the PBAC Permission Engine's booking-access authorization logic.
Is a fix available?
A pull request to fix the issue exists but was awaiting acceptance at the time of publication. The provided information does not identify an accepted fixed release or an interim mitigation.