CVE-2026-16624

9.6 Critique

Publiée le 22/07/2026 à 21:16 · Modifiée le 24/10/2026 à 15:10 · En attente d'analyse NVD · Source : cret@cert.org

Description

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.

Traduire en français

Produits concernés

Cal.com Cal.diy

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.6 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-639

Références

https://github.com/calcom/cal.diy/security/advisories/GHSA-4fwh-xxpv-xfm6
https://vokecyber.com/research/calcom-cross-tenant-webhook-plant
https://vokecyber.com/research/calcom-cross-tenant-webhook-plant

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories