Cal Com
Monthly
Stored cross-site scripting in the self-hosted Cal.com (Cal.diy) scheduling platform, versions 2.1.1 through 6.2.0, lets an authenticated event owner break out of an inline analytics script string literal in the BookingPageTagManager component by supplying an unsanitized tracking ID, causing attacker-controlled JavaScript to run for every visitor of the public booking page. The flaw enables session-cookie theft, forging of authenticated actions, and self-propagating (wormable) spread by chaining to CSRF-able endpoints. No public exploit identified at time of analysis, though a third-party technical write-up exists.
Authorization bypass in Cal.com DIY allows any authenticated user to create webhooks on arbitrary teams by injecting an unvalidated teamId, enabling exfiltration of sensitive booking data including organizer/attend
Cal.com scheduling software (3.1.6 to 6.0.7) has a critical authentication bypass in the NextAuth JWT callback. Attackers can gain full access to any user account by supplying a target email via session.update(). Fixed in 6.0.7.
Authorization bypass in Cal.com and cal.diy through 6.2.0 allows any authenticated user to manipulate the ID argument in the webhook creation procedure and attach or alter webhooks on team-scoped event types or team webhooks without being an ADMIN or OWNER. The pre-patch code verified only eventType.userId, so team-owned resources were reachable by non-members; impact is limited to webhook configuration and secrets rather than full account takeover (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). No public exploit was identified at time of analysis, and an upstream fix is proposed in PR #30223 but a released patched version was not independently confirmed.
Improper privilege management in cal.com and its cal.diy fork up to version 6.2.0 lets an authenticated low-privilege user delete credential objects belonging to teams they are not authorized to manage. By calling the credentials.delete tRPC procedure with a teamId outside their scope, an attacker can remove scheduling/calendar integration credentials, causing a limited integrity and availability impact on the targeted team; no data is disclosed and no victim interaction is required. Publicly available exploit code exists (a proof-of-concept gist is referenced), and the vendor did not respond to the disclosure, so no fixed version has been identified; the assessed CVSS 3.1 vector is 6.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, making this a low-priority issue that still requires a valid account to abuse.
Authentication bypass in Cal.com before 5.9.8 allows remote unauthenticated attackers to skip password verification by submitting a TOTP code in the login flow, potentially taking over accounts where TOTP is enabled. Publicly available exploit code exists, and while the EPSS score is low at 0.15% (35th percentile), the vendor has released a fix in 5.9.8. The independent assessment rates this as a genuine high-priority issue with network reachability and no user interaction required.
Cal.com is open-source scheduling software. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Access Control in GitHub repository calcom/cal.com prior to 2.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Stored cross-site scripting in the self-hosted Cal.com (Cal.diy) scheduling platform, versions 2.1.1 through 6.2.0, lets an authenticated event owner break out of an inline analytics script string literal in the BookingPageTagManager component by supplying an unsanitized tracking ID, causing attacker-controlled JavaScript to run for every visitor of the public booking page. The flaw enables session-cookie theft, forging of authenticated actions, and self-propagating (wormable) spread by chaining to CSRF-able endpoints. No public exploit identified at time of analysis, though a third-party technical write-up exists.
Authorization bypass in Cal.com DIY allows any authenticated user to create webhooks on arbitrary teams by injecting an unvalidated teamId, enabling exfiltration of sensitive booking data including organizer/attend
Cal.com scheduling software (3.1.6 to 6.0.7) has a critical authentication bypass in the NextAuth JWT callback. Attackers can gain full access to any user account by supplying a target email via session.update(). Fixed in 6.0.7.
Authorization bypass in Cal.com and cal.diy through 6.2.0 allows any authenticated user to manipulate the ID argument in the webhook creation procedure and attach or alter webhooks on team-scoped event types or team webhooks without being an ADMIN or OWNER. The pre-patch code verified only eventType.userId, so team-owned resources were reachable by non-members; impact is limited to webhook configuration and secrets rather than full account takeover (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). No public exploit was identified at time of analysis, and an upstream fix is proposed in PR #30223 but a released patched version was not independently confirmed.
Improper privilege management in cal.com and its cal.diy fork up to version 6.2.0 lets an authenticated low-privilege user delete credential objects belonging to teams they are not authorized to manage. By calling the credentials.delete tRPC procedure with a teamId outside their scope, an attacker can remove scheduling/calendar integration credentials, causing a limited integrity and availability impact on the targeted team; no data is disclosed and no victim interaction is required. Publicly available exploit code exists (a proof-of-concept gist is referenced), and the vendor did not respond to the disclosure, so no fixed version has been identified; the assessed CVSS 3.1 vector is 6.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, making this a low-priority issue that still requires a valid account to abuse.
Authentication bypass in Cal.com before 5.9.8 allows remote unauthenticated attackers to skip password verification by submitting a TOTP code in the login flow, potentially taking over accounts where TOTP is enabled. Publicly available exploit code exists, and while the EPSS score is low at 0.15% (35th percentile), the vendor has released a fix in 5.9.8. The independent assessment rates this as a genuine high-priority issue with network reachability and no user interaction required.
Cal.com is open-source scheduling software. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper Access Control in GitHub repository calcom/cal.com prior to 2.7. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.