Executive brief
Cal.com, a popular open-source scheduling platform, contains a flaw that allows any registered user to secretly monitor the bookings of other teams. By exploiting this vulnerability, an attacker can redirect real-time notifications of new meetings to their own server. This results in the theft of sensitive information, including participant names, email addresses, phone numbers, and even passwords for video conference calls, without the victim's knowledge.
Technical details
A Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the 'viewer.webhook.create' API endpoint of Cal.com's open-source and self-hosted editions. The root cause is a failure to validate the 'teamId' field provided in the request; while the system correctly identifies the caller, it fails to verify if that caller has administrative rights over the specified team before persisting the webhook. An attacker with any valid account can perform a single POST request to plant a webhook on a target team. Once planted, the attacker receives a real-time feed of all booking events, including PII (names, emails, phones) and meeting credentials. This issue stems from the use of stubbed permission-check services in the open-source build that return 'allowed' by default.
Affected products
- Cal.com Cal.diy < 6.2.0
- Cal.com Cal.com Community Edition master @ commit a4a01a0 and prior
Timeline
- 2026-07-22: disclosed: Vulnerability disclosed by Voke Cyber; no vendor patch available at time of publication.
- 2026-07-22: advisory