calcom vulnerabilities

Products

• cal.diy 11
• cal.com 5
• calcom/cal.com 1

Latest calcom CVEs

Newest publication first

1. CVE-2026-112043 calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization

   Published 2026-10-19

   Medium·CVSS 5.3 EPSS 0.36%

   A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to auth...

2. CVE-2026-109143 calcom cal.com/cal.diy Credentials delete credentials.delete privileges management

   Published 2026-10-13

   Medium·CVSS 5.3 EPSS 0.22%

   A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege m...

3. CVE-2026-104054 calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

   Published 2026-10-02

   Medium·CVSS 5.3 EPSS 0.21%

   A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be in...

4. CVE-2024-58355 Cal.com through 4.7.15 Cross-Site Scripting via booking questions

   Published 2026-07-23

   Critical·CVSS 9.3 EPSS 0.42%

   Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user inp...

5. CVE-2025-71389 Cal.com before 5.9.9 Remote Code Execution via RSC

   Published 2026-07-23

   Critical·CVSS 10.0 EPSS 1.4%

   Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to th...

6. CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow

   Published 2026-07-23

   High·CVSS 8.5 EPSS 0.49%

   cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_target trigger with the repository's default write permissions and passes them down to check-types.yml....

7. CVE-2024-58353 Cal.com through 4.7.15 Cross-Site Scripting via booking questions

   Published 2026-07-23

   Critical·CVSS 9.3 EPSS 0.42%

   Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>). Booking question (form field) labels are rendered via React's dangerouslySetInnerHTML without proper input s...

8. CVE-2026-63768 cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

   Published 2026-07-20

   Medium·CVSS 5.3 EPSS 0.34%

   cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field...

9. CVE-2026-9349 calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure

   Published 2026-05-24

   Medium·CVSS 6.9 EPSS 0.41%

   A vulnerability was determined in calcom cal.diy up to 4.9.4. Affected by this issue is the function getServerSideProps of the file apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the component Generic React API. This manipulation of the argument ca...

10. CVE-2026-9304 calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery

    Published 2026-05-23

    Low·CVSS 2.3 EPSS 0.20%

    A security flaw has been discovered in calcom cal.diy up to 4.9.4. The affected element is the function validateUrlForSSRF of the file apps/web/app/api/logo/route.ts of the component Logo API. The manipulation results in server-side request forgery. It is possible to launch the a...

11. CVE-2026-9303 calcom cal.diy cross-site request forgery

    Published 2026-05-23

    Medium·CVSS 5.3 EPSS 0.19%

    A vulnerability was identified in calcom cal.diy up to 4.9.4. Impacted is an unknown function. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early...

12. CVE-2026-23478 Cal.com has an Authentication Bypass via Unvalidated Email in Custom JWT Callback

    Published 2026-01-13

    Critical·CVSS 10.0 EPSS 0.47%

    Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerab...

13. CVE-2025-66489 Cal.com Authentication Bypass via bad TOTP + password checks

    Published 2025-12-03

    Critical·CVSS 9.9 EPSS 0.97%

    Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic con...

14. CVE-2023-37919 Cal.com not expiring old sessions after enabling 2FA

    Published 2023-07-25

    Medium·CVSS 5.4 EPSS 0.31%

    Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other devi...

15. CVE-2023-1647 Improper Access Control in calcom/cal.com

    Published 2023-03-27

    High·CVSS 8.8 EPSS 0.84%

    Improper Access Control in GitHub repository calcom/cal.com prior to 2.7.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.