CVE-2026-109143: calcom cal.com/cal.diy Credentials delete credentials.delete privileges management
A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege management. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of Cal.com or cal.diy at version 6.2.0 or earlier are identified as affected. The vulnerable functionality is the credentials deletion endpoint at /api/trpc/credentials/delete.
What does an attacker need to exploit it?
The attack can be initiated remotely and requires low privileges, as reflected by the PR:L vector. Exploitation involves manipulating the teamId argument supplied to the credentials.delete function.
Is public exploitation information available?
Yes. The exploit has been publicly disclosed and may be used by attackers.
What is the impact of successful exploitation?
The issue can allow improper privilege management in credential deletion operations. The provided severity vector indicates low integrity and availability impact, with no confidentiality impact.