Repository Takeover Vulnerability in cal.com by Cal.com
CVE-2024-58354

8.5HIGH

Key Information:

Vendor

Calcom

Status
Cal.diy
Vendor
CVE Published:
23 July 2026

What is CVE-2024-58354?

Cal.com's repository is vulnerable to a severe repository takeover due to flaws in its GitHub Actions workflows. The vulnerability primarily resides in the pr.yml workflow that leverages the pull_request_target trigger with default write permissions. This misconfiguration allows an attacker to leverage the permissions linked to the repository's GITHUB_TOKEN to execute arbitrary code from malicious pull requests. By successfully crafting such pull requests, adversaries can potentially alter the repository, push unauthorized commits, merge pull requests, and manipulate branches. The flaw affects all operations managed via the main branch, leaving the repository open to exploitation until a fix is implemented. Currently, no patched version has been released.

References

https://github.com/calcom/cal.diy/security/advisories/GHS...
vendor-advisory
https://github.com/calcom/cal.diy/commit/9aa60fae41a6b6b1...
patch
https://www.vulncheck.com/advisories/cal-com-repository-t...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

jsoref
.