Cal.com CVE-2026-112043

Exploitation requires an authenticated account on the cal.com/cal.diy instance (CVSS PR:L) and targets the webhook management path (createWebhookProcedure in packages/trpc/server/routers/viewer/webhook/util.ts). The specific prerequisite is the presence of team-owned webhooks or event types: the pre-patch code only compared eventType.userId to the caller and performed no team membership or ADMIN/OWNER role check, so the flaw is exercised against team-scoped resources by manipulating the ID argument. Limiting factors: the attacker must first authenticate (no unauthenticated/anonymous path), impact is bounded to webhook configuration/secrets rather than full account or system compromise (VC:L/VI:L/VA:L, no scope change), and instances with no team-based webhooks have a reduced attack surface. Affected versions are up to and including 6.2.0.

This is a moderate, authenticated authorization-bypass (IDOR, CWE-639) in cal.com/cal.diy's webhook handler, best characterized as a real-but-not-urgent issue rather than a high-priority emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) scores 5.3 (Medium): network-reachable and low-complexity, but requiring low-level privileges (PR:L) - i.e., any authenticated account on the instance - and yielding only Low confidentiality/integrity/availability impact with no scope change. The source-code diff confirms the root cause: the pre-patch createWebhookProcedure checked only eventType.userId against the caller and omitted team-ownership/membership-role checks, so a logged-in user could manipulate the ID argument to act on team-owned webhooks/event types they should not control. There is no CISA KEV listing and no public exploit code identified in the provided data, and EPSS was not supplied - so there is no signal of active or widespread exploitation; this contrasts with the network/low-complexity vector, which indicates it is technically easy to attempt once authenticated. Note a data conflict to verify: the free-text Description says 'The pull request to fix this issue awaits acceptance,' while the Patch field states 'Available from vendor' and reference PR #30223 is tagged as the patch - confirm with the vendor whether a released fix is actually merged/shipped. The vector was also issued only in CVSS 4.0 form (no 3.1 provided) and the exploitation maturity is E:X (not defined).

An attacker who holds any low-privilege authenticated account on a cal.com/cal.diy instance (e.g., a basic member of, or outsider to, a team) sends crafted tRPC webhook requests supplying the ID of a team-owned webhook or event type they do not administer. Because the pre-patch code validated only the individual userId and not team membership/role, the server processes the request, letting the attacker bypass authorization to view or manipulate webhooks belonging to a team or other users. No public exploit code was identified in the provided data, though the fix diff publicly reveals the vulnerable logic.