CVE-2026-16624

Cal.com OSS contains a vulnerability where lack of authorization on webhook teamId creation allows any authenticated user to create a webhook on any team via unvalidated teamId injection, enabling access to booking data (organizer/attendee emails, custom responses) and, in some cases, video-call ...