CVE-2026-23478

Katalog CVE

CVSS 9.8 · Critical EPSS 0,47%

Kerentanan Client-Side Enforcement of Server-Side Security pada cal.com. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7.

Rincian

Terbit di NVD

13 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-602: Client-Side Enforcement of Server-Side Security
CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/calcom/cal.com/security/advisories/GHSA-7hg4-x4pr-3hrg advisory pihak ketiga