Description (CNA)
A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| calcom / cal.com | affected 6.0; affected 6.1; affected 6.2.0 |
| calcom / cal.diy | affected 6.0; affected 6.1; affected 6.2.0 |
CWE
CWE-639, CWE-285
References
- https://vuldb.com/vuln/421691
- https://vuldb.com/vuln/421691/cti
- https://vuldb.com/cve/CVE-2026-112043
- https://vuldb.com/submit/1009017
- https://github.com/calcom/cal.diy/issues/29982
- https://github.com/calcom/cal.diy/pull/30223
ADP enrichment
No English description supplied.