CVE-2026-104054: calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

Vulnerability summary

CVE-2026-104054 is a medium (CVSS 6.5) Missing Authorization vulnerability in calcom cal.diy. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 10.5% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 02-10-2026
   PublishedVulnerability first disclosed.
2. 02-10-2026
   Last modifiedVulnerability information updated.

Description

A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.