Calcom
Monthly
Authorization bypass in Cal.com and cal.diy through 6.2.0 allows any authenticated user to manipulate the ID argument in the webhook creation procedure and attach or alter webhooks on team-scoped event types or team webhooks without being an ADMIN or OWNER. The pre-patch code verified only eventType.userId, so team-owned resources were reachable by non-members; impact is limited to webhook configuration and secrets rather than full account takeover (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). No public exploit was identified at time of analysis, and an upstream fix is proposed in PR #30223 but a released patched version was not independently confirmed.
Improper privilege management in cal.com and its cal.diy fork up to version 6.2.0 lets an authenticated low-privilege user delete credential objects belonging to teams they are not authorized to manage. By calling the credentials.delete tRPC procedure with a teamId outside their scope, an attacker can remove scheduling/calendar integration credentials, causing a limited integrity and availability impact on the targeted team; no data is disclosed and no victim interaction is required. Publicly available exploit code exists (a proof-of-concept gist is referenced), and the vendor did not respond to the disclosure, so no fixed version has been identified; the assessed CVSS 3.1 vector is 6.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, making this a low-priority issue that still requires a valid account to abuse.
Remote code execution in Cal.com's cal.diy product before 5.9.9 allows an unauthenticated attacker to run arbitrary code on the server by sending a crafted React Server Components (RSC) request. The flaw stems from a bundled vulnerable Next.js version (upstream CVE-2025-55182) that unsafely deserializes attacker-controlled input in the React flight protocol. Rated CVSS 4.0 10.0 (critical) with no authentication or user interaction required; no public exploit identified at time of analysis, though the underlying Next.js class of bug is well documented via the GHSA advisory.
Information disclosure in Cal.com cal.diy up to version 4.9.4 allows remote unauthenticated attackers to access sensitive booking data through manipulation of cancelledBy/rescheduledBy parameters in the bookings single view API endpoint. The vulnerability affects the Generic React API's getServerSideProps function, enabling unauthorized retrieval of booking-related information. Public exploit code exists demonstrating the attack technique, and the vendor has not responded to coordinated disclosure attempts, leaving users at elevated risk until patches are self-applied.
Server-side request forgery in Cal.com cal.diy versions up to 4.9.4 enables authenticated attackers to make the server perform arbitrary HTTP requests to internal or external systems via the Logo API endpoint. The vulnerable validateUrlForSSRF function in apps/web/app/api/logo/route.ts insufficiently validates user-supplied URLs, allowing bypass of SSRF protections. Public exploit code exists (EPSS data not provided), though exploitation complexity is high (CVSS AC:H) requiring low-level privileges and technical sophistication. The vendor received early notification but has not responded or released a patch.
Cross-site request forgery (CSRF) in Cal.com cal.diy versions up to 4.9.4 enables remote attackers to perform unauthorized actions on behalf of authenticated users through specially crafted requests. Public exploit code is available via GitHub Gist, lowering the barrier for exploitation. The vendor was notified but has not responded or released a patch, leaving users dependent on compensating controls. EPSS data unavailable, but the combination of low attack complexity (AC:L), no authentication requirement (PR:N), and available exploit code (E:P) elevates practical exploitation risk above the base CVSS score of 4.3.
Authorization bypass in Cal.com and cal.diy through 6.2.0 allows any authenticated user to manipulate the ID argument in the webhook creation procedure and attach or alter webhooks on team-scoped event types or team webhooks without being an ADMIN or OWNER. The pre-patch code verified only eventType.userId, so team-owned resources were reachable by non-members; impact is limited to webhook configuration and secrets rather than full account takeover (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). No public exploit was identified at time of analysis, and an upstream fix is proposed in PR #30223 but a released patched version was not independently confirmed.
Improper privilege management in cal.com and its cal.diy fork up to version 6.2.0 lets an authenticated low-privilege user delete credential objects belonging to teams they are not authorized to manage. By calling the credentials.delete tRPC procedure with a teamId outside their scope, an attacker can remove scheduling/calendar integration credentials, causing a limited integrity and availability impact on the targeted team; no data is disclosed and no victim interaction is required. Publicly available exploit code exists (a proof-of-concept gist is referenced), and the vendor did not respond to the disclosure, so no fixed version has been identified; the assessed CVSS 3.1 vector is 6.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, making this a low-priority issue that still requires a valid account to abuse.
Remote code execution in Cal.com's cal.diy product before 5.9.9 allows an unauthenticated attacker to run arbitrary code on the server by sending a crafted React Server Components (RSC) request. The flaw stems from a bundled vulnerable Next.js version (upstream CVE-2025-55182) that unsafely deserializes attacker-controlled input in the React flight protocol. Rated CVSS 4.0 10.0 (critical) with no authentication or user interaction required; no public exploit identified at time of analysis, though the underlying Next.js class of bug is well documented via the GHSA advisory.
Information disclosure in Cal.com cal.diy up to version 4.9.4 allows remote unauthenticated attackers to access sensitive booking data through manipulation of cancelledBy/rescheduledBy parameters in the bookings single view API endpoint. The vulnerability affects the Generic React API's getServerSideProps function, enabling unauthorized retrieval of booking-related information. Public exploit code exists demonstrating the attack technique, and the vendor has not responded to coordinated disclosure attempts, leaving users at elevated risk until patches are self-applied.
Server-side request forgery in Cal.com cal.diy versions up to 4.9.4 enables authenticated attackers to make the server perform arbitrary HTTP requests to internal or external systems via the Logo API endpoint. The vulnerable validateUrlForSSRF function in apps/web/app/api/logo/route.ts insufficiently validates user-supplied URLs, allowing bypass of SSRF protections. Public exploit code exists (EPSS data not provided), though exploitation complexity is high (CVSS AC:H) requiring low-level privileges and technical sophistication. The vendor received early notification but has not responded or released a patch.
Cross-site request forgery (CSRF) in Cal.com cal.diy versions up to 4.9.4 enables remote attackers to perform unauthorized actions on behalf of authenticated users through specially crafted requests. Public exploit code is available via GitHub Gist, lowering the barrier for exploitation. The vendor was notified but has not responded or released a patch, leaving users dependent on compensating controls. EPSS data unavailable, but the combination of low attack complexity (AC:L), no authentication requirement (PR:N), and available exploit code (E:P) elevates practical exploitation risk above the base CVSS score of 4.3.