PT-2026-63446 · Cal.Com · Cal.Com Oss

CVE-2026-16624 · Published 2026-07-22 · Updated 2026-07-22

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Cal.com OSS (affected versions not specified)

Description An authorization flaw exists during the creation of webhooks. An authenticated user can perform an unvalidated injection of the teamId variable to create a webhook for any team. This allows the attacker to steal booking data, such as organizer and attendee emails, custom responses, and potentially video-call passwords, by triggering the delivery of the webhook.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2026-16624

GHSA-4FWH-XXPV-XFM6

Affected Products

Cal.Com Oss

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16624.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-16624 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-16624 · Security Note
• https://github.com/calcom/cal.diy/security/advisories/GHSA-4fwh-xxpv-xfm6 · Note
• https://vokecyber.com/research/calcom-cross-tenant-webhook-plant · Note