Improper Privilege Management in Calcom Cal.com and Cal.diy
CVE-2026-109143

5.3MEDIUM

Key Information:

Vendor: Calcom
Status: Cal.com; Cal.diy
Vendor: CVE Published:; 13 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-109143?

A critical issue has been identified in Calcom Cal.com and Cal.diy, specifically in the Credentials Handler. The vulnerability arises from improper privilege management in the credentials.delete function located in the /api/trpc/credentials/delete file. This flaw allows for the manipulation of the teamId argument, granting remote attackers the ability to exploit the system. As a result, unauthorized users may gain access to sensitive operations without the necessary permissions. Although the vendor was notified of this security risk, they did not respond. The issue has been publicly disclosed, raising significant concerns about its potential exploitation.

Affected Version(s)

cal.com 6.0

cal.com 6.1

cal.com 6.2.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-109143 - Proof of Concept