EUVD-2026-98375
GHSA-72px-hx9f-mc45
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
DeliveryCraft credentials.delete request with foreign teamId
-
ExploitTrigger improper privilege management check
-
ExecutionDelete another team's credentials
-
ImpactDisrupt integration availability/integrity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege account on a cal.com or cal.diy instance (version up to 6.2.0) reachable over the network; the attacker invokes the credentials.delete tRPC procedure and supplies a teamId outside their authorized scope, exploiting missing privilege/ownership enforcement. Limiting factors: valid authentication is required (PR:L - not unauthenticated), impact is confined to deletion of credential objects (no data disclosure), and no user interaction from a victim is needed. |
| Impact | This is a low-priority vulnerability despite being remotely reachable. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) yields a base score of only 2.1 because exploitation requires an already-authenticated low-privilege account (PR:L), produces no confidentiality impact (VC:N), and only limited integrity and availability impact (VI:L/VA:L) - consistent with an improper privilege management (CWE-269) flaw where manipulating the teamId argument lets a user act on credentials outside their authorized scope. Signals are mutually consistent rather than conflicting: a public proof-of-concept exists (E:P in the vector and a referenced gist), but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active or widespread exploitation. The report originates solely from VulDB and the vendor (calcom) did not respond to disclosure, meaning affected-version and patch details are not vendor-confirmed. Net: a genuine authorization bug worth patching on exposure-sensitive deployments, but not an emergency - the low privilege barrier combined with limited, non-confidentiality impact keeps real-world risk low. |
| Exploit ScenarioDerived | A low-privileged authenticated user of a cal.com or cal.diy instance sends a crafted request to /api/trpc/credentials/delete, supplying a teamId they do not own to delete integration credentials belonging to another team. A public proof-of-concept exploit is available (referenced gist), lowering the effort required, though the attacker must first hold a valid low-privilege account on the target instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Improper privilege management in cal.com and its cal.diy fork up to version 6.2.0 lets an authenticated low-privilege user delete credential objects belonging to teams they are not authorized to manage. By calling the credentials.delete tRPC procedure with a teamId outside their scope, an attacker can remove scheduling/calendar integration credentials, causing a limited integrity and availability impact on the targeted team; no data is disclosed and no victim interaction is required. Publicly available exploit code exists (a proof-of-concept gist is referenced), and the vendor did not respond to the disclosure, so no fixed version has been identified; the assessed CVSS 3.1 vector is 6.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, making this a low-priority issue that still requires a valid account to abuse.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to the report - so operators of self-hosted cal.com or cal.diy instances (version 6.2.0 or earlier) must apply compensating controls. The most direct mitigation is a server-side authorization patch: in the credentials.delete tRPC resolver, resolve the caller's membership from the session and reject any teamId where the caller is not an owner/admin, rather than trusting the client-supplied teamId; this is a small code change but requires maintaining a fork until upstream ships a fix. Until then, restrict access to the /api/trpc/credentials/delete route at the reverse proxy or WAF for non-admin roles (blocking the procedure for regular users), accepting that legitimate team members will lose the ability to delete their own credentials through the UI; alternatively, restrict the entire /api/trpc/credentials/* path to trusted IP ranges or to admins only, at the cost of breaking credential management for ordinary users. Audit logs for credential deletion events should be enabled and reviewed for unexpected teamId values, and credentials for affected teams should be backed up or rotated so deleted integrations can be restored; general network hardening will not remediate this, since the attacker only needs a legitimate low-privilege account. Monitor the VulDB entries (https://vuldb.com/vuln/416882) and the cal.com repository for an upstream fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
cal.com is an open-source scheduling platform exposing a tRPC API surface under /api/trpc/, including a credentials.delete mutation handled by the credentials handler. The flaw is a missing ownership/privilege check: the procedure accepts a teamId argument and deletes the associated credential record without verifying that the caller is a member or admin of that team, which is the classic CWE-269 (Improper Privilege Management) root cause - an authorization decision is delegated to client-supplied identifier data rather than enforced server-side against the session principal. Because tRPC endpoints are directly reachable over HTTP, any authenticated session can invoke the mutation; the vulnerability is a vertical/horizontal authorization bypass rather than a memory-safety or injection class issue, and the affected code paths are shared between the upstream cal.com project and the cal.diy fork, as reflected in the CPE identifiers cpe:2.3:a:calcom:cal.com:*:*:*:*:*:*:*:* and cpe:2.3:a:calcom:cal.diy:*:*:*:*:*:*:*:*.
Know when Cal Diy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable tRPC endpoint (AV:N/AC:L) requires an authenticated low-privilege account (PR:L); unauthorized credential deletion gives limited integrity/availability impact (I:L/A:L) with no disclosure (C:N).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege management. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote code execution in Cal.com's cal.diy product before 5.9.9 allows an unauthenticated attacker to run arbitrary code
Authorization bypass in Cal.com DIY allows any authenticated user to create webhooks on arbitrary teams by injecting an
Information disclosure in Cal.com cal.diy up to version 4.9.4 allows remote unauthenticated attackers to access sensitiv
Cross-site request forgery (CSRF) in Cal.com cal.diy versions up to 4.9.4 enables remote attackers to perform unauthoriz
Server-side request forgery in Cal.com cal.diy versions up to 4.9.4 enables authenticated attackers to make the server p
Exploit-DB