Calendly open source alternatives

Nearly every "best open-source Calendly alternative" article recommends Cal.com. That recommendation is out of date, and following it today would be a mistake. On 14 April 2026 the calcom/cal.com repository was renamed to calcom/cal.diy, relicensed from AGPL-3.0 to MIT, and stripped of all enterprise code. The project's own README now says it is "strictly recommended for personal, non-production use."

We verified that against the upstream repository, Docker Hub, and the NVD vulnerability database rather than taking anyone's word for it. What we found changed the article we intended to write. So here is an argument you don't often see on a site that earns affiliate revenue from hosting recommendations: for most small teams, keep paying Calendly.

Below: what actually happened to Cal.com, Calendly's real 2026 prices pulled from its own structured data, the lighter alternatives that are still healthy, and the specific circumstances where self-hosting still makes sense.

1. What happened to Cal.com

Cal.com spent years as the reference answer to "open-source Calendly." It was AGPL-licensed, self-hostable, and genuinely full-featured. In April 2026 the company split the project in two.

The commercial product remains Cal.com. The open-source remainder became Cal.diy, and its README is unusually direct:

"Use at your own risk. Cal.diy is the open source community edition of Cal.com and it is intended for users who want to self-host their own Cal.diy instance. It is strictly recommended for personal, non-production use."

"For any commercial and enterprise-ready scheduling infrastructure, use Cal.com, not Cal.diy."

The README enumerates what was removed:

• Teams — shared team scheduling
• Organizations — multi-team hierarchy, company subdomains
• Insights — booking analytics
• Workflows — automated reminders and follow-ups
• SSO / SAML — enterprise authentication

To be fair to Cal.com, the trade is not entirely one-sided. Moving from AGPL to MIT is a genuine liberalisation for anyone who wanted to build commercial software on top of the code, and the licence-key requirement is gone. If you are a solo operator who wants unlimited event types on your own box, Cal.diy still does that under a permissive licence.

But "the open-source Calendly alternative for your team" is no longer an accurate description of it.

The distribution numbers tell the real story

GitHub stars are a poor health signal here, and this case demonstrates why. The repository still shows roughly 46,700 stars — those were accumulated over five years as Cal.com and they did not disappear when the project changed shape. A star count will never tell you that a licence flipped underneath you.

Docker Hub is far more revealing, because it measures whether anyone is actually deploying the thing:

Image	Pulls	Last updated
calcom/cal.com (the old image)	4,484,723	2 March 2026
calcom/cal.diy (the current one)	0	14 April 2026

Zero pulls, three months after the pivot, while the README still displays a Docker Pulls badge. The old image stopped being updated in March. Practically speaking, every "docker compose up" tutorial for self-hosted Cal.com that you'll find in a search result is now obsolete.

Commit cadence points the same direction. Over the last twelve months the repository recorded thousands of commits; over the most recent four weeks, 13. That is not a project being actively developed in the open — mainline development moved to the commercial repository.

2. The security situation, stated plainly

This is the part that turned our recommendation around, and it is the reason we are not going to walk you through a self-hosting tutorial.

The NVD vulnerability database lists 9 CVEs for this package. Four of them were published on 22-23 July 2026 — days before we checked. The most serious:

CVE	CVSS	Published	What it is
CVE-2025-71389	10.0	23 Jul 2026	Unauthenticated remote code execution
CVE-2024-58354	9.9	23 Jul 2026	Critical
CVE-2026-23478	9.8	13 Jan 2026	Critical
CVE-2025-66489	9.8	3 Dec 2025	Critical
CVE-2024-58353 / 58355	8.9	23 Jul 2026	High

NVD's description of the 10.0 is specific, and it names the renamed package directly:

"Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction."

Read that carefully: without authentication or user interaction. No login required, no one has to click anything. A CVSS 4.0 score of 10.0 is the ceiling.

Some context is only fair. This particular flaw comes from a bundled Next.js dependency rather than Cal.com's own application logic, so it is a supply-chain issue that affected a wide range of Next.js applications. A fix exists — upgrade past 5.9.9. And a burst of CVE publications sometimes reflects a researcher working through one codebase systematically, not a sudden collapse in quality.

But the combination is what matters for a self-hosting decision: a project the vendor tells you not to run in production, with no working Docker distribution, 13 commits in the last month, and an unauthenticated RCE published this week. If you deploy that on a public URL and don't watch it closely, you are running an internet-facing service that takes arbitrary code from strangers.

3. What Calendly actually costs in 2026

We pulled these from the structured data embedded in Calendly's own pricing page on 25 July 2026, so they are Calendly's numbers rather than our estimates. All figures are per seat per month on annual billing.

Tier	Per seat / mo	Key limits
Free	$0	1 event type, 1 calendar
Standard	$10	Unlimited event types, Stripe/PayPal, Zapier, HubSpot
Teams	$16	Adds round-robin, Salesforce routing, SSO
Enterprise	from $15,000/yr	SAML, audit logs, domain control

Annual cost by team size:

Team	Standard	Teams
1 person	$120	$192
3 people	$360	$576
10 people	$1,200	$1,920

Two things worth flagging that comparison articles routinely miss.

The free tier's real constraint is 1 event type. Not a booking cap, not a time limit. One event type. Anyone who offers both a short intro call and a longer session is over the line on day one. It's an elegantly chosen limit.

The invoice minimum is $5,000. Calendly's own pricing FAQ states that paying by invoice on Standard or Teams requires $5,000, and Enterprise $15,000. For a company whose finance team won't put a card on file, Calendly's entry price is not $360 — it's $5,000. This is the single most under-reported number in the category.

We could not verify monthly (non-annual) per-seat prices: Calendly renders them client-side, so they are not in the page source. The page labels annual billing as saving 16% on Standard and 20% on Teams, which implies roughly $11.90 and $20.00 monthly, but since we could not read those figures from source we're flagging them as derived rather than stating them as fact.

4. Alternatives that are still healthy

With Cal.diy off the table for production use, the honest open-source shortlist is thinner than it was a year ago — and each option involves a real compromise.

Easy!Appointments (~4,300 stars, PHP)

Easy!Appointments is a mature PHP appointment-booking app that runs on ordinary LAMP shared hosting — no Node build step, no Postgres. If you already run WordPress somewhere, you can almost certainly run this alongside it. The trade-off is that it's built around service-and-provider booking (think clinics and salons) rather than the frictionless "grab a slot on my calendar" flow Calendly popularised, and the interface looks its age.

Rallly (~5,200 stars, TypeScript)

Rallly is well maintained and pleasant to use, but be clear about what it is: it replaces Doodle, not Calendly. It polls a group for the times that suit everyone. It does not publish your live availability for one-way booking. If your actual need is "stop the email thread about when six people can meet," Rallly is the better tool. If your need is "let prospects book me," it isn't a substitute.

CloudMeet (~510 stars)

Small project, but architecturally interesting: it runs on Cloudflare's free tier, so hosting cost is genuinely zero and there's no server for you to patch. At this size, treat it as a project you're adopting with your eyes open — read the code, expect to contribute fixes, don't bet a revenue-critical booking flow on it.

Cal.com's own free cloud tier

Worth naming because it's the pragmatic answer people overlook: Cal.com's hosted Free plan covers 1 user with unlimited event types and calendars, plus Stripe and PayPal payments and Calendly event import. For a solo consultant, that beats both Calendly's free tier (1 event type) and self-hosting (patching an RCE).

Where it stops being free is teams. Cal.com's paid Teams tier is $12 per seat per month billed annually against Calendly's $16 for the comparable tier — so if you need round-robin, routing forms, or shared team availability, that is a genuine 25% cut on a feature-for-feature basis rather than a downgrade. Organizations is $28 per seat per month. Verified from Cal.com's pricing page on 25 July 2026.

5. The self-hosting cost nobody mentions

Suppose you disregard our advice and self-host anyway. The VPS is the cheap part — around $6-12/month. Here's what the savings calculators leave out.

Google OAuth verification. A scheduling tool is useless unless it can read and write your calendar. Google treats calendar event access as a sensitive scope. If people outside your organisation will book through your app, you must pass OAuth verification: prove domain ownership, publish a privacy policy, and usually supply a demo video. If the app is only for you, or only for users inside your own Google Workspace, you can remain in Testing mode and skip it. That distinction decides whether setup takes an afternoon or several weeks, and no pricing comparison mentions it.

Transactional email. Booking confirmations and reminders have to arrive. That means SMTP credentials, SPF and DKIM records, and a sending reputation. Free tiers exist, but "my confirmation emails land in spam" is a worse outcome than paying Calendly.

Patching, now on you. Given the CVE record above, this is not a background chore. It's the main ongoing cost.

Add it up and self-hosting a scheduler to replace a $360/year tool means taking on OAuth review, deliverability, and security response. The arithmetic rarely works.

6. The verdict

Keep paying Calendly if you're a small team on Standard or Teams, your bill is a few hundred dollars a year, and scheduling reliability affects your revenue. Scheduling is a poor place to economise: when it breaks, you don't get an error message, you get a prospect who silently never books.

Use Cal.com's free cloud tier if you're a solo operator currently hitting Calendly's 1-event-type wall. Unlimited event types, no server, no CVE watch. This is the best-value move for most individuals reading this, and it costs nothing.

Move your team to Cal.com Teams if you need round-robin, routing forms, or shared availability and you're currently on Calendly Teams at $16 per seat. Cal.com Teams is $12 per seat per month billed annually for comparable team features — $576/year becomes $432/year at 3 seats, $1,920 becomes $1,440 at 10. The feature parity claim is checkable on both vendors' pricing pages, and we've linked them.

Consider Easy!Appointments if you have data-residency requirements or genuinely unusual booking logic, and you already run PHP hosting. Mature, boring, self-hostable.

Reach for Rallly if what you actually needed all along was group poll scheduling rather than one-way booking.

Revisit Cal.diy in six months. A community fork may stabilise, publish Docker images, and establish a patch cadence. It isn't there in July 2026.

The case for switching gets much stronger once per-seat pricing dominates your costs. At 25 seats on Teams, Calendly is $4,800/year and a managed self-hosted deployment starts to look reasonable. At 3 seats and $360, it does not.

Sources: Calendly pricing page structured data and Cal.com pricing page (fetched 25 July 2026); calcom/cal.diy README and repository metadata via the GitHub API; Docker Hub registry API pull counts; NVD CVE records for CVE-2025-71389, CVE-2024-58353/58354/58355, CVE-2026-23478, CVE-2025-66489; Google Identity documentation on sensitive scopes. Monthly Calendly per-seat pricing could not be read from source and is not asserted here.

Affiliate disclosure: Cal.com links on this page are affiliate links and we may earn a commission if you start a paid Cal.com plan through them. We have no affiliate relationship with Calendly. Rankings and verdicts on this page were written before the Cal.com links were added and were not changed to suit them.