Authorization Flaw in Cal.com OSS Allows Webhook Manipulation by Authenticated Users

CVE-2026-16624

What is CVE-2026-16624?

Cal.com OSS contains a significant vulnerability that permits any authenticated user to create webhooks for any team. This occurs due to a lack of proper authorization on teamId creation, allowing for unvalidated injection of teamId. Consequently, this allows malicious actors to extract sensitive booking information such as organizer and attendee emails, custom responses, and potentially even video call passwords. The exploitation can lead to significant data breaches and compromise user privacy by triggering the delivery of malicious webhooks.

References