EUVD-2026-47769Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Primary rating from Vendor (certcc) · only source for this CVE.
CVSS VectorVendor: certcc
Lifecycle Timeline
5DescriptionCVE.org
Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.
AnalysisAI
Authorization bypass in Cal.com DIY allows any authenticated user to create webhooks on arbitrary teams by injecting an unvalidated teamId, enabling exfiltration of sensitive booking data including organizer/attend
Remote code execution in Cal.com's cal.diy product before 5.9.9 allows an unauthenticated attacker to run arbitrary code
Information disclosure in Cal.com cal.diy up to version 4.9.4 allows remote unauthenticated attackers to access sensitiv
Cross-site request forgery (CSRF) in Cal.com cal.diy versions up to 4.9.4 enables remote attackers to perform unauthoriz
Server-side request forgery in Cal.com cal.diy versions up to 4.9.4 enables authenticated attackers to make the server p
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today