TI-2026-76231 Aliases CVE-2026-112043 GHSA-6wcv-37vq-r5jx

Authorization bypass in cal.com and cal.diy webhook handler

MEDIUM 57CWE-285Published 2026-10-19 · Updated 2026-10-19

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

The calcom cal.com and cal.diy packages up to 6.2.0 contain an authorization flaw in the webhook handler. Manipulating the ID argument of the createWebhookProcedure function leads to an authorization bypass (CWE-639). A remote attacker with low privileges can exploit it without user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00364 30th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
calcom	cal.com	6.0; 6.1; 6.2.0	—	No fix listed	CNA
calcom	cal.diy	6.0; 6.1; 6.2.0	—	No fix listed	CNA

cal.com Vendorcalcom Affected 6.0; 6.1; 6.2.0 Fixed in — No fix listed CNA
cal.diy Vendorcalcom Affected 6.0; 6.1; 6.2.0 Fixed in — No fix listed CNA

CPE names CNA · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:calcom:cal.com::::::::	—	—	—
cpe:2.3:a:calcom:cal.diy::::::::	—	—	—

cpe:2.3:a:calcom:cal.com:*:*:*:*:*:*:*:* Versions — — ·—
cpe:2.3:a:calcom:cal.diy:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

The sources list no fixed version for cal.com or cal.diy.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-19 Threatist record created from CVE-2026-112043
2026-10-19 Alias added: GHSA-6wcv-37vq-r5jx
2026-10-19 CISA SSVC decision points changed
2026-10-19 Priority changed: LOW → MEDIUM

References

Patch 1

https://github.com/calcom/cal.diy/pull/30223

Other 1

https://github.com/calcom/cal.diy/issues/29982

TI-2024-38439 Cal.com through 4.7.15 Cross-Site Scripting via booking questions CVSS 4.0CRITICAL 9.3
TI-2024-38437 Cal.com through 4.7.15 Cross-Site Scripting via booking questions CVSS 4.0CRITICAL 9.3
TI-2024-38438 cal.com Repository Takeover via pull_request_target Workflow CVSS 4.0HIGH 8.5
TI-2026-08199 calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure CVSS 4.0MEDIUM 6.9
TI-2023-19352 Cal.com not expiring old sessions after enabling 2FA CVSS 3.1MEDIUM 6.5
TI-2026-71619 Improper privilege management in Cal.com credential deletion CVSS 4.0MEDIUM 5.3

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences