PT-2026-117213

CVE-2026-112043

Published

2026-10-19

Updated

2026-10-19

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cal.com versions prior to 6.2.1 cal.diy versions prior to 6.2.1

Description An authorization bypass exists in the Webhook Handler component. A remote attacker can manipulate the ID argument within the createWebhookProcedure() function located in the packages/trpc/server/routers/viewer/webhook/util.ts file to bypass security checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Geochen

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

CWE-285: Improper Authorization

Related identifiers