calcom cal.diy vulnerabilities

Latest calcom cal.diy CVEs

Newest publication first

1. CVE-2026-112043 calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization

   Published 2026-10-19

   Medium·CVSS 5.3 EPSS 0.36%

   A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to auth...

2. CVE-2026-109143 calcom cal.com/cal.diy Credentials delete credentials.delete privileges management

   Published 2026-10-13

   Medium·CVSS 5.3 EPSS 0.22%

   A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege m...

3. CVE-2026-104054 calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

   Published 2026-10-02

   Medium·CVSS 5.3 EPSS 0.21%

   A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in missing authorization. The attack can be in...

4. CVE-2024-58355 Cal.com through 4.7.15 Cross-Site Scripting via booking questions

   Published 2026-07-23

   Critical·CVSS 9.3 EPSS 0.42%

   Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user inp...

5. CVE-2025-71389 Cal.com before 5.9.9 Remote Code Execution via RSC

   Published 2026-07-23

   Critical·CVSS 10.0 EPSS 1.4%

   Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to th...

6. CVE-2024-58354 cal.com Repository Takeover via pull_request_target Workflow

   Published 2026-07-23

   High·CVSS 8.5 EPSS 0.49%

   cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_target trigger with the repository's default write permissions and passes them down to check-types.yml....

7. CVE-2024-58353 Cal.com through 4.7.15 Cross-Site Scripting via booking questions

   Published 2026-07-23

   Critical·CVSS 9.3 EPSS 0.42%

   Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>). Booking question (form field) labels are rendered via React's dangerouslySetInnerHTML without proper input s...

8. CVE-2026-63768 cal.diy 6.2.0 Conferencing OAuth Callback Open Redirect via Unsigned State

   Published 2026-07-20

   Medium·CVSS 5.3 EPSS 0.34%

   cal.diy through 6.2.0 contains an open redirect vulnerability in the conferencing OAuth callback endpoint that allows attackers to redirect users to arbitrary URLs by crafting malicious state parameters. Attackers can exploit the unsigned state parameter and onErrorReturnTo field...

9. CVE-2026-9349 calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure

   Published 2026-05-24

   Medium·CVSS 6.9 EPSS 0.41%

   A vulnerability was determined in calcom cal.diy up to 4.9.4. Affected by this issue is the function getServerSideProps of the file apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the component Generic React API. This manipulation of the argument ca...

10. CVE-2026-9304 calcom cal.diy Logo API route.ts validateUrlForSSRF server-side request forgery

    Published 2026-05-23

    Low·CVSS 2.3 EPSS 0.20%

    A security flaw has been discovered in calcom cal.diy up to 4.9.4. The affected element is the function validateUrlForSSRF of the file apps/web/app/api/logo/route.ts of the component Logo API. The manipulation results in server-side request forgery. It is possible to launch the a...

11. CVE-2026-9303 calcom cal.diy cross-site request forgery

    Published 2026-05-23

    Medium·CVSS 5.3 EPSS 0.19%

    A vulnerability was identified in calcom cal.diy up to 4.9.4. Impacted is an unknown function. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.