| Title | Cal.com (Cal.com, Inc.) Cal.com/Cal.diy (self-hosted) <= 6.2.0 Missing Authorization |
|---|
| Description | Cal.com self hosted up to 6.2.0 exposes the credentials.delete tRPC endpoint, which deletes a team credential using a teamId taken straight from the request without checking that the caller belongs to that team. The credential id and teamId are small incrementing integers, so any authenticated user can iterate them and delete every team's connected integrations across the instance. |
|---|
| Source | ⚠️ https://gist.github.com/k4z01/7f7739e59ae595f7bdd45922adf2b547 |
|---|
| User | k4z0 (UID 101097) |
|---|
| Submission | 09/14/2026 18:42 (1 month ago) |
|---|
| Moderation | 10/12/2026 13:24 (28 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416882 [calcom cal.com/cal.diy up to 6.2.0 Credentials delete credentials.delete teamId privileges management] |
|---|
| Points | 19 |
|---|