CVE-2026-112043

calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization

State: Published
Severity: 5.3 Medium
Published: Oct 19, 2026
Updated: Oct 19, 2026
Reserved: Oct 18, 2026

Description

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:C	VulDB

Weaknesses

CWE-639 Authorization Bypass
CWE-285 Improper Authorization

Affected Products

Product	Versions
cal.comcalcom	6.0Affected 6.1Affected 6.2.0Affected
cal.diycalcom	6.0Affected 6.1Affected 6.2.0Affected

References

VDB-421691 | calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorizationvdb-entrytechnical-description
VDB-421691 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-112043 | CVE Analysis and Reportthird-party-advisory
Submit #1009017 | https://github.com/calcom/ cal.diy a46d5f8dd4a9e5a821c7c7f54ef5d2e5999e445d Authorization Bypassthird-party-advisory
https://github.com/calcom/cal.diy/issues/29982issue-tracking
https://github.com/calcom/cal.diy/pull/30223issue-trackingpatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.