---
id: "CVE-2026-112043"
kind: "vulnerability"
aliases: ["CVE-2026-112043"]
title: "Cal.com: webhook creation flaw lets remote users bypass authorization"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cal.com", "cal.diy", "package", "self-hosted", "webhooks"]
not_affected_if: ["unknown"]
published_at: "2026-10-19T03:16:58+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:57:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112043", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Cal.com: webhook creation flaw lets remote users bypass authorization

A weakness in the webhook creation handler of cal.com and cal.diy up to 6.2.0 lets an attacker manipulate the ID argument to bypass authorization. The sources say the attack can be launched remotely, and a fix pull request is pending.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed cal.com or cal.diy version against `6.2.0`; unknown whether a patched release exists yet
- Look for the webhook router at `packages/trpc/server/routers/viewer/webhook/util.ts` in your source tree

## Fix

- Unknown: the sources say only that a fix pull request awaits acceptance
- Watch the cal.com and cal.diy releases and upgrade past `6.2.0` once a fix ships

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112043

## From the sources

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_