felhom.eu/documentation/audits/security-app-updates-2026-10-27/triage-notes/calcom.md

calcom — triage (group D)

Pins: calcom/cal.com:v6.2.0 (source repo calcom/cal.diy), postgres:18-alpine.

GHSA-p3f6-52gv-cj7m (critical, 2024) — NOT-A-FINDING: about the project's own CI (pull_request_target workflow

.github/workflows/pr.yml / check-types.yml repo takeover), not the shipped product.

GHSA-cpf2-q635-xrwx / CVE-2023-37919 (low, 2023) — NOT-A-FINDING: range "app.cal.com" (hosted service); NVD CPE

range ends at <= 3.1.4, far below v6.2.0. Unsure whether v6.2.0 now ends other sessions on 2FA enable (NextAuth JWT sessions); even if not, it only matters to an attacker who already holds a stolen session. Lane: NOT_A_FINDING. No target. Side observation: Docker Hub calcom/cal.com newest tag is v6.2.0 (2026-03-02) and the release list ends there — no image in ~8 months; worth a staleness check (abandoned/renamed image?). Classifier note: drop advisories whose title names .github/workflows/action.yml, and ranges that are a hostname.