LiveActive security incident?Get immediate response
CVE Record

CVE-2026-57858: Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close the inline script string literal with a crafted payload that executes in the browser of every visitor to the affected public booking page, enabling session cookie theft, forged authenticated requests, and wormable propagation by chaining with CSRF-able endpoints to persist payloads on additional events.

CriticalCVSS 9.3Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

Cal.com Self-Hosted installations running Cal.diy 2.1.1 through 6.2.0 may allow an authenticated event owner to place malicious JavaScript on a public booking page. Visitors could have sessions compromised or actions performed through their browsers. Because booking pages are public and the content persists, a single malicious configuration could affect many visitors.

Executive priority

Treat as an urgent remediation item for affected self-hosted deployments, especially multi-user or externally accessible systems. Prioritize inventory, access restriction, configuration review, and vendor-confirmed upgrading. Escalate immediately if suspicious analytics identifiers or anomalous booking-page activity are found.

Technical view

BookingPageTagManager embeds an event owner-controlled analytics tracking ID into an inline script without adequate sanitization. Crafted input can escape the intended JavaScript string and execute whenever the affected booking page loads. The supplied assessment identifies confidentiality and integrity impact, including possible cross-event propagation through other endpoints, but does not establish exploitation in the wild.

Likely exposure

Exposure is likely limited to self-hosted Cal.diy versions 2.1.1 through 6.2.0 where authenticated event owners can configure analytics tracking IDs. Risk rises when untrusted users can own events or public booking pages receive substantial traffic. The bundle does not identify hosted Cal.com as affected.

Exploitation context

Exploitation requires an authenticated event owner to store malicious input, followed by a visitor opening the affected public booking page. The CVE is not listed as KEV in the supplied bundle, and no cited evidence establishes active exploitation. Persistent delivery and potential propagation increase impact if abused.

Researcher notes

The supplied evidence attributes the flaw to improper output handling in BookingPageTagManager and classifies it as CWE-79 with CVSS 4.0 score 9.3. No fixed version or vendor mitigation is supplied. The structured affected entry lists only 2.1.1, while the narrative states 2.1.1 through 6.2.0; confirm the authoritative range with vendor guidance.

Mitigation direction

  • Check Cal.com security guidance for a fixed release and upgrade promptly when confirmed.
  • Restrict event-owner accounts and analytics configuration access until remediation is verified.
  • Review configured analytics tracking IDs and remove suspicious or unexpected values.
  • Consider temporarily disabling affected analytics functionality or public pages if vendor guidance supports it.

Validation and detection

  • Inventory self-hosted Cal.diy versions and identify deployments within 2.1.1 through 6.2.0.
  • Identify events using analytics tracking IDs and review values for unexpected script-related content.
  • Confirm public booking pages do not render owner-controlled tracking identifiers unsafely.
  • After remediation, verify installed versions and repeat booking-page security testing in an isolated environment.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2026-57858 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.3 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

2CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

2 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.3CVSS 4.0CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L——VulnCheck
8.9CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L2.36VulnCheck

Vulnerability scoring details

Base CVSS 4.0 score

9.3Critical
CVSS 4.0 vector shape for CVE-2026-57858Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Cal.comCal.com Self-Hosted (Cal.diy)2.1.1affected
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-79 · source CWE mapping

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs