CVE-2026-16624

Name of the Vulnerable Software and Affected Versions Cal.com OSS (affected versions not specified)

Description An authorization flaw exists during the creation of webhooks. An authenticated user can perform an unvalidated injection of the teamId variable to create a webhook for any team. This allows the attacker to steal booking data, such as organizer and attendee emails, custom responses, and potentially video-call passwords, by triggering the delivery of the webhook.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.