LOW 2.1 NVD
CVE-2026-104054
A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts o
A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
References
- https://github.com/calcom/cal.diy/
- https://github.com/calcom/cal.diy/issues/29802
- https://github.com/calcom/cal.diy/pull/30253
- https://vuldb.com/cve/CVE-2026-104054
- https://vuldb.com/submit/959492
This low severity vulnerability with a CVSS score of 2.1 was published on 2026-10-02 via NVD.
vulnfeed aggregates 9442 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.