CVE-2026-16624 in cal.com
Summary
by MITRE • 07/22/2026
Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within the open source calendaring platform cal.com where insufficient authorization controls are implemented in the webhook creation functionality. The flaw stems from improper validation of the teamId parameter during webhook setup processes, allowing any authenticated user to inject arbitrary team identifiers when creating webhooks. This represents a critical access control weakness that directly violates the principle of least privilege and enables unauthorized data exfiltration through malicious webhook delivery mechanisms.
The technical implementation fails to verify whether the authenticated user has legitimate authorization rights to create webhooks for the specified teamId, creating an injection vector that permits cross-team data access. When an attacker crafts a webhook with a teamId belonging to another organization, they can capture sensitive booking information including email addresses of organizers and attendees, custom form responses, and potentially video call passwords when conditional delivery triggers occur. This vulnerability directly maps to CWE-285 which addresses insufficient authorization in software systems.
The operational impact is severe as attackers can systematically harvest booking data from multiple teams within the platform, potentially compromising user privacy and organizational security. The stolen information includes personal contact details, scheduling preferences, and potentially sensitive meeting credentials that could be used for social engineering attacks or further exploitation. This capability enables data breach scenarios where unauthorized parties gain access to calendaring data across different organizational boundaries.
Security mitigations should include implementing robust teamId validation during webhook creation processes, establishing proper authorization checks that verify user permissions against target teams, and implementing rate limiting on webhook creation attempts. Additionally, the platform should enforce strict access controls using role-based permissions and implement logging mechanisms to detect anomalous webhook creation patterns. Organizations should also consider implementing network-level monitoring to detect suspicious webhook delivery activities and ensure proper separation of team data through database-level access controls.
This vulnerability aligns with several ATT&CK techniques including T1078 for valid accounts usage and T1566 for credential harvesting through social engineering. The exposure of booking data could facilitate further attacks such as phishing campaigns using stolen email addresses or targeted social engineering attempts leveraging personal scheduling information. Organizations should implement comprehensive monitoring solutions that track webhook creation events and alert on unauthorized cross-team access patterns to prevent exploitation of this authorization bypass vulnerability.
The root cause of this issue demonstrates a fundamental flaw in the platform's permission model where team boundaries are not properly enforced during webhook configuration. This represents a classic authorization bypass scenario where user input validation is insufficient to prevent privilege escalation through parameter manipulation. The vulnerability requires minimal technical skill to exploit and can result in significant data compromise across multiple organizations using the same platform instance, making it particularly dangerous in multi-tenant environments.