{"id":"CVE-2026-112043","kind":"vulnerability","aliases":["CVE-2026-112043"],"related":[],"title":"Cal.com: webhook creation flaw lets remote users bypass authorization","description":"A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.","summary":"A weakness in the webhook creation handler of cal.com and cal.diy up to 6.2.0 lets an attacker manipulate the ID argument to bypass authorization. The sources say the attack can be launched remotely, and a fix pull request is pending.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cal.com","cal.diy","package","self-hosted","webhooks"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed cal.com or cal.diy version against `6.2.0`; unknown whether a patched release exists yet\n- Look for the webhook router at `packages/trpc/server/routers/viewer/webhook/util.ts` in your source tree","fix":"- Unknown: the sources say only that a fix pull request awaits acceptance\n- Watch the cal.com and cal.diy releases and upgrade past `6.2.0` once a fix ships","status":"open","published_at":"2026-10-19T03:16:58+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:57:25+00:00","updated_at":"2026-10-25T03:57:25+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T03:57:25Z","model":"claude-haiku-5-5","output":{"fix":"- Unknown: the sources say only that a fix pull request awaits acceptance\n- Watch the cal.com and cal.diy releases and upgrade past `6.2.0` once a fix ships","reach":"internet","title":"Cal.com: webhook creation flaw lets remote users bypass authorization","impact":"medium","summary":"A weakness in the webhook creation handler of cal.com and cal.diy up to 6.2.0 lets an attacker manipulate the ID argument to bypass authorization. The sources say the attack can be launched remotely, and a fix pull request is pending.","category":"package","nicknames":[],"who_cares":["cal.com","cal.diy","self-hosted","webhooks"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker bypasses authorization on webhook creation, altering another user's webhooks","analyst_note":"Find the fix pull request and the affected-version details at https://nvd.nist.gov/vuln/detail/CVE-2026-112043 and confirm whether authentication is required.","how_to_check":"- Check the installed cal.com or cal.diy version against `6.2.0`; unknown whether a patched release exists yet\n- Look for the webhook router at `packages/trpc/server/routers/viewer/webhook/util.ts` in your source tree","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that self-host cal.com or cal.diy at version 6.2.0 or earlier, where the webhook creation endpoint is reachable. The sources do not say whether hosted cal.com is affected or what default configuration is needed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000634,"input_tokens":3352,"output_tokens":597,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112043':12A,15A '-2026':11A,14A '6.2.0':36B,75C 'accept':118C 'argument':43B,95C 'attack':39B,51B,108C 'author':9A,46B,100C 'await':117C 'bypass':8A,45B,101C 'cal.com':1A,16B,31B,70C 'cal.diy':17B,33B,72C 'calcom':69C 'compon':87C 'createwebhookprocedur':80C 'creation':3A,28B 'cve':10A,13A 'execut':90C 'file':83C 'fix':58B,114C 'flaw':4A 'function':79C 'handler':29B,89C 'host':21B 'id':42B,96C 'identifi':67C 'impact':76C 'issu':116C 'launch':54B,106C 'lead':98C 'let':5A,37B 'manipul':40B,92C 'packag':18B 'packages/trpc/server/routers/viewer/webhook/util.ts':84C 'pend':62B 'possibl':104C 'pull':59B,111C 'remot':6A,55B,109C 'request':60B,112C 'say':49B 'self':20B 'self-host':19B 'sourc':48B 'user':7A 'weak':24B,64C 'webhook':2A,22B,27B,88C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host cal.com or cal.diy at version 6.2.0 or earlier, where the webhook creation endpoint is reachable. The sources do not say whether hosted cal.com is affected or what default configuration is needed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T03:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112043","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112043","severity":null,"published_at":"2026-10-19T03:16:58+00:00","modified_at":"2026-10-19T17:17:09+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}