CVE-2026-104054 | calcom cal.diy up to 6.2.0 PBAC Permission Engine BookingAccessService.ts doesUserIdHaveAccessToBooking authorization (Issue 29802)

October 1, 2026 Yanac

A vulnerability classified as critical has been found in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization.

This vulnerability is identified as CVE-2026-104054. The attack can be initiated remotely. Additionally, an exploit exists.

The pull request to fix this issue awaits acceptance.VulDB Recent EntriesRead More