CVE-2026-16624

Back Back to CVE browser

CRITICAL

Published Jul 22, 2026

9.6

CRITICAL

CVSS 3.1

EPSS 0.40%

Description

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.

Affected products

Vendor Cal.com Product Cal.diy Default
unknown
Affected
- ≥ 0, < 6.2.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Cal.com	Cal.diy	unknown	Affected ≥ 0, < 6.2.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-639

Authorization Bypass

References (3)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-47769		Advisory
https://github.com/calcom/cal.diy/security/advisories/GHSA-4fwh-xxpv-xfm6
https://vokecyber.com/research/calcom-cross-tenant-webhook-plant		exploit

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner certcc

Published Jul 22, 2026

Updated Jul 27, 2026

Reserved Jul 22, 2026

Link CVE-2026-16624

CISA Vulnrichment

Updated Jul 27, 2026

NVD

Status Awaiting Analysis

Modified Jul 27, 2026

Link CVE-2026-16624

Red Hat

No data

ENISA EUVD

Assigner certcc

Published Jul 22, 2026

Updated Jul 27, 2026

Link EUVD-2026-47769

GitHub

No data