CVE-2026-112043: calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization
A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Cal.com Cal.com and Cal.com cal.diy deployments up to version 6.2.0 are identified as affected. The issue is in the Webhook Handler's createWebhookProcedure function.
What does an attacker need to exploit this issue?
The attack can be launched remotely and involves manipulating an ID argument. The provided data does not state that user interaction is required; the severity vector indicates low privileges are required.
What is the impact of successful exploitation?
Successful exploitation can bypass authorization controls. The supplied severity vector indicates potential low impact to confidentiality, integrity, and availability.
Is a fix available?
A pull request intended to fix the issue is awaiting acceptance. No accepted patch or fixed version is provided in the available data.