CVE-2026-16624

The Cal.com OSS platform is vulnerable to an authorization bypass during the creation of webhooks. An authenticated user can perform an unvalidated injection of the teamId variable, enabling them to create a webhook for any team. By triggering a webhook delivery, an attacker can steal booking dat...