CVE-2026-104054

Name of the Vulnerable Software and Affected Versions calcom cal.diy versions prior to 6.2.1

Description A security flaw in the PBAC Permission Engine component allows for missing authorization. The issue resides in the doesUserIdHaveAccessToBooking() function within the BookingAccessService.ts file. This flaw can be exploited remotely through manipulation to bypass authorization checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the doesUserIdHaveAccessToBooking() function within the BookingAccessService.ts file.