# CVE-2026-112043: Cal.com authorization bypass in webhook handler

Source: https://junglewise.ai/threats/cve-2026-112043-a-weakness-has-been-identified-in-calcom-cal-com-and-cal-diy-up  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-112043 · Severity: medium · CVSS 6.3 · Published 2026-10-19

Cal.com is a scheduling and meeting management platform that handles booking events and team workflows. A flaw in the webhook authorization logic allows any authenticated team member to hijack team webhooks by redirecting them to attacker-controlled URLs, enabling the theft of sensitive attendee data including names, emails, phone numbers, and custom booking information from all future bookings.

Technologies: [Cal.Com](https://junglewise.ai/threats/technologies/cal-com), [Cal.com Cal.diy](https://junglewise.ai/threats/technologies/cal-diy). Vendors: [Cal.com](https://junglewise.ai/threats/vendors/cal-com).

## Quick answers

**Is CVE-2026-112043 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112043 being exploited in the wild.

**How severe is CVE-2026-112043?** Medium severity, with a CVSS score of 6.3, published 19 October 2026.

**Which products and versions are affected?** Cal.Com up to 6.2.0; Cal.com Cal.diy up to 6.2.0.

**Is there a fix for CVE-2026-112043?** Yes: fixed in A pull request (#30223) exists to fix this issue; specific fixed versions are not yet released in the advisory.. Until then: Restrict team member permissions to prevent non-admin users from accessing or modifying webhook settings, or temporarily disable team webhooks until an update is available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112043 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-112043?** Check whether you run Cal.Com or Cal.com Cal.diy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in A pull request (#30223) exists to fix this issue; specific fixed versions are not yet released in the advisory.

Restrict team member permissions to prevent non-admin users from accessing or modifying webhook settings, or temporarily disable team webhooks until an update is available.

## Technical details

An authorization bypass exists in the createWebhookProcedure middleware (packages/trpc/server/routers/viewer/webhook/util.ts) where team-level webhooks bypass ownership checks because webhook.userId is null; the missing check on webhook.teamId allows any authenticated user to modify team webhooks via the edit endpoint. An attacker with team member privileges can call viewer.webhook.edit with a valid team webhook UUID to redirect the subscriberUrl to their server, receiving the signing secret and all future booking event payloads. The fix adds explicit team membership validation requiring ADMIN or OWNER role before allowing webhook modifications.

## Affected products

- Cal.com cal.com up to 6.2.0
- Cal.com cal.diy up to 6.2.0

## Timeline

- 2026-06-21: disclosed: Vulnerability reported via email
- 2026-10-19: advisory: Public advisory published
- 2026-09-22: other: Fix PR #30223 submitted for acceptance

## References

- [https://github.com/calcom/cal.diy/issues/29982](https://github.com/calcom/cal.diy/issues/29982)
- [https://github.com/calcom/cal.diy/pull/30223](https://github.com/calcom/cal.diy/pull/30223)

## Related threats

- [Cal.com credentials delete cross-team privilege escalation](https://junglewise.ai/threats/cve-2026-109143-a-vulnerability-was-determined-in-calcom-cal-com-and-cal-diy-up)
- [Cal.com cal.diy PBAC permission engine authorization bypass](https://junglewise.ai/threats/cve-2026-104054-a-security-flaw-has-been-discovered-in-calcom-cal-diy-up-to-6-2)
- [Cal.com remote code execution via Next.js RSC deserialization](https://junglewise.ai/threats/cve-2025-71389-cal-com-remote-code-execution-via-next-js-rsc-deserialization)
- [Cal.com stored XSS in booking question labels](https://junglewise.ai/threats/cve-2024-58355-cal-com-stored-xss-in-booking-question-labels)
- [Calcom cal.diy repository takeover via GitHub Actions pull_request_target](https://junglewise.ai/threats/cve-2024-58354-calcom-cal-diy-repository-takeover-via-github-actions-pull)