Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID
CVSS score
9.3
EPSS probability
%0.4
Risk score
0.0
Published
2 mo ago
Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.
Impact on My Inventory
Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.
Checking session…
Vulnerability description
CVE AI research
DayBreach AI Explanation
Verified against sourcesSources read
1
Source agreement
Tam uyum
Evidence confidence
%53
Short explanation
Cal.com Cal.diy versions 2.1.1 to 6.2.0 have a stored XSS vulnerability in BookingPageTagManager that allows authenticated users to inject malicious JavaScript via unvalidated analytics tracking IDs. This enables session hijacking and payload persistence. CVSS score is 9.3 (Critical). Patch status is UNKNOWN. No public exploit or active exploitation is confirmed.
This vulnerability allows attackers to steal session cookies and perform authenticated actions on behalf of users, enabling session hijacking and lateral movement. It is particularly dangerous due to public exposure of booking pages and potential for chaining with CSRF endpoints to persist payloads.
What should be done?
- Upgrade to Cal.diy version 6.3.0 or later (vendor advisory required).
- Do not use versions 2.1.1 through 6.2.0.
- Validate and sanitize all analytics tracking ID inputs before processing.
The sources give limited detail on some technical conditions. Review the chain of evidence below before deciding how to act.
Chain of evidence and sources
Cal.com Cal.diy 2.1.1 ile 6.2.0 arasında, BookingPageTagManager bileşeninde saklı bir cross-site scripting (XSS) eksikliği vardır. Bu eksiklik, kimlik doğrulamalı kullanıcıların, analitik izleme kimliği ile herhangi bir JavaScript'i eklemesini sağlar.
Eksiklik, her bir public rezervasyon sayfasına ziyaret eden kullanıcıların tarayıcılarında kötü niyetli betikleri çalıştırmasını sağlar. Bu, oturum çerezlerinin çalınması, doğrulamalı isteklerin sahteleştirilmesi ve CSRF uç noktalarıyla ilerleyen (wormable) yayılımın olabilirliğini sağlar.
CVSS puanı 9.3 (Kritik) olup, yüksek ciddiyet ve düşük yetki gereksinimleri ile kolayca istismar edilebilir.
Show the technical text from the sources
Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close the inline script string literal with a crafted payload that executes in the browser of every visitor to the affected public booking page, enabling session cookie theft, forged authenticated requests, and wormable propagation by chaining with CSRF-able endpoints to persist payloads on additional events.
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
CWE: CWE-79
Explanation produced with the local qwen3:4b-instruct model. Numerical metrics and the KEV, patch and exploit statuses are not determined by AI.
IMPACT: Affected Products and Software
Affected Products
The following products are affected by CVE-2026-57858 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.
| ID | VENDOR | PRODUCT | ACTION |
|---|---|---|---|
| 1 | Cal.com | Cal.com Self-Hosted (Cal.diy) | View |
RED HAT CSAF/VEX: Product Impact Check
SCORING: CVSS from Multiple Sources
CVSS Scores
The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 9.3 | CVSS V40 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD |
| 9.3 | CVSS V4_0 | CRITICAL | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L | CVE CNA |
| 8.9 | CVSS V31 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L | NVD |
| 8.9 | CVSS V3_1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L | CVE CNA |
Patch and Remediation Guide
Solution & Remediation Advisory
İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.
Public exploit and active exploitation status
Verified exploit intelligence
No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.
Weakness Classification and Attack Patterns (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-57858 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-57858 weaknesses.
Attack Vector and Accessibility
Official Sources and Advisories
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-57858"