Cal.com Cross-Tenant Webhook Plant: Auth Bypass via Unvalidated teamId (Critical)

Here is the summary of key vulnerability information from the webpage screenshot: --- Vulnerability Overview Title: Cross-Tenant Webhook Plant in Cal.com — Authorization Bypass via Unvalidated teamId Advisory: Voke Cyber Security Advisory Published Date: July 22, 2026 Author: Louis Sanchez CVE: To be assigned (Coordinated with CERT/CC, VRF#26-06-RPFHL) CVSS v3.1 Base Score: 9.6 (Critical) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L Weaknesses: CWE-639 — Authorization Bypass Through User-Controlled Key (IDOR) CWE-982 — Missing Authorization Affected Products: Cal.com Self-Hosted (Community Edition) Cal.diy SaaS; master branch up to commit a4a03a0 and earlier Patch Status: No patch available (not fixed at time of publication) Reporter: Louis Sanchez — Voke Cyber Coordinator: Coordinated with CERT/CC; vendor did not respond during the coordination period --- Impact Scope Confidentiality (High): Leaks the name, email, phone number, organizer’s email, video conferencing link, and password of all booking attendees. Integrity (High): Attackers can forge signed webhook messages for phishing or tampering with downstream systems. Scope (Changed): Affects cross-tenant attendees and hosts, independent of the attacker’s account permissions. Prerequisites: Any authenticated Cal.com account (including free accounts) is sufficient to exploit. Exploitation Method: By guessing the victim team’s numeric ID (obtained from public booking pages) and sending an API request to create a webhook pointing to an attacker-controlled URL. --- Remediation Workaround (for Self-Hosted Users): 1. Audit the webhook table: Flag all webhook entries where the owner is not a member of the bound team. 2. Review Subscriber URLs: Inspect the of each active webhook and remove links pointing to unknown destinations. 3. Rotate Exposed Data: If planted webhooks are discovered, assume attendee data and video credentials from affected bookings have been leaked; regenerate them. Root Fix Recommendations: Validate during webhook creation: Ensure the caller is an admin or owner of the team. Apply the same ownership check to existing webhooks, and delete or edit paths accordingly. Open-source builds should include a functional permission engine rather than stub code that silently returns "allow." --- POC Code --- Additional Notes Root Cause: The field was not validated and written directly to the database, causing webhooks to be misattributed to the wrong team. Broader Issue: The open-source version uses a stub permission engine that silently disables role checks, leading to multiple low-severity vulnerabilities. Disclosure Timeline: - 2026-05-20: Discovery and initial report - 2026-06: Coordination with CERT/CC - 2026-07: Vendor unresponsive, security advisory published - 2026-07-22: Public disclosure --- > Note: Advertisements and footer content at the bottom of the page have been omitted.

Goal Reached Thanks to every supporter — we hit 100%!

Cal.com Cross-Tenant Webhook Plant: Auth Bypass via Unvalidated teamId (Critical)