Live › vulnerability › CVE-2026-112043
Go to dashboardA weakness in the webhook creation handler of cal.com and cal.diy up to 6.2.0 lets an attacker manipulate the ID argument to bypass authorization. The sources say the attack can be launched remotely, and a fix pull request is pending.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host cal.com or cal.diy at version 6.2.0 or earlier, where the webhook creation endpoint is reachable. The sources do not say whether hosted cal.com is affected or what default configuration is needed.
No product ranges from the sources yet.
6.2.0; unknown whether a patched release exists yetpackages/trpc/server/routers/viewer/webhook/util.ts in your source tree6.2.0 once a fix shipsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
This page as .md · .json · in your agent: get_signal("CVE-2026-112043")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.