CVE-2026-16624 CVE-2026-16624

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords...

CVE-2026-16624

The Cal.com OSS platform is vulnerable to an authorization bypass during the creation of webhooks. An authenticated user can perform an unvalidated injection of the teamId variable, enabling them to create a webhook for any team. By triggering a webhook delivery, an attacker can steal booking dat...