Unrated severityNVD Advisory· Published Jul 22, 2026· Updated Jul 27, 2026

CVE-2026-16624

Description

Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.

Affected products

Calcom/Cal.comllm-fuzzy

Patches

Vulnerability mechanics

References

github.com/calcom/cal.diy/security/advisories/GHSA-4fwh-xxpv-xfm6mitre
vokecyber.com/research/calcom-cross-tenant-webhook-plantmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000