Is CVE-2026-16624 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16624 being exploited in the wild.

How severe is CVE-2026-16624?

Informational severity, with a CVSS score of 9.6, published 22 July 2026.

Which products and versions are affected?

Cal.com Community Edition master @ commit a4a01a0 and prior; Cal.com Cal.diy < 6.2.0.

Is there a fix for CVE-2026-16624?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-16624 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-16624?

Check whether you run Cal.com Community Edition or Cal.com Cal.diy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16624: Cal.com OSS authorization bypass in webhook creation

Q: Is there a fix for CVE-2026-16624?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-16624 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-16624?

Check whether you run Cal.com Community Edition or Cal.com Cal.diy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16624 · Severity: info · CVSS 9.6 · Published 2026-07-22

Cal.com, a popular open-source scheduling platform, contains a flaw that allows any registered user to secretly monitor the bookings of other teams. By exploiting this vulnerability, an attacker can redirect real-time notifications of new meetings to their own server. This results in the theft of sensitive information, including participant names, email addresses, phone numbers, and even passwords for video conference calls, without the victim's knowledge.

Technologies: Cal.com Cal.diy. Vendors: Cal.com.

Quick answers

Is CVE-2026-16624 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16624 being exploited in the wild.
How severe is CVE-2026-16624?: Informational severity, with a CVSS score of 9.6, published 22 July 2026.
Which products and versions are affected?: Cal.com Community Edition master @ commit a4a01a0 and prior; Cal.com Cal.diy < 6.2.0.
Is there a fix for CVE-2026-16624?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16624 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-16624?: Check whether you run Cal.com Community Edition or Cal.com Cal.diy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Broken Object Level Authorization (BOLA/IDOR) vulnerability exists in the 'viewer.webhook.create' API endpoint of Cal.com's open-source and self-hosted editions. The root cause is a failure to validate the 'teamId' field provided in the request; while the system correctly identifies the caller, it fails to verify if that caller has administrative rights over the specified team before persisting the webhook. An attacker with any valid account can perform a single POST request to plant a webhook on a target team. Once planted, the attacker receives a real-time feed of all booking events, including PII (names, emails, phones) and meeting credentials. This issue stems from the use of stubbed permission-check services in the open-source build that return 'allowed' by default.

Affected products

Cal.com Cal.diy < 6.2.0
Cal.com Cal.com Community Edition master @ commit a4a01a0 and prior

Timeline

2026-07-22: disclosed: Vulnerability disclosed by Voke Cyber; no vendor patch available at time of publication.
2026-07-22: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.