GHSA-6wcv-37vq-r5jxMediumCVSS 6.3
A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the...
🔗 CVE IDs covered (1)
📋 Description
A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
🔗 References (8)
- https://nvd.nist.gov/vuln/detail/CVE-2026-112043
- https://github.com/calcom/cal.diy/issues/29982
- https://github.com/calcom/cal.diy/pull/30223
- https://vuldb.com/cve/CVE-2026-112043
- https://vuldb.com/submit/1009017
- https://vuldb.com/vuln/421691
- https://vuldb.com/vuln/421691/cti
- https://github.com/advisories/GHSA-6wcv-37vq-r5jx