CVE-2026-16624
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Cal.com OSS lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.
Risk Assessment
An attacker can access sensitive booking data, including contact information and video call passwords, compromising user confidentiality and privacy.
Recommendation
Update Cal.com OSS to a version that implements proper authorization for webhook creation.
Original NVD description (English source)
Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.