CVE-2026-16624 Overview
CVE-2026-16624 is a broken access control vulnerability in Cal.com open-source scheduling software. The flaw resides in the webhook creation endpoint, which fails to authorize the teamId parameter supplied by the client. Any authenticated user can inject an arbitrary teamId and register a webhook against a team they do not belong to. Once the planted webhook fires, it exfiltrates booking payloads to an attacker-controlled endpoint. Leaked data includes organizer and attendee email addresses, custom form responses, and, under specific conditions, video-call passwords.
Critical Impact
Cross-tenant data theft. An authenticated user can plant webhooks on any team and receive booking payloads containing organizer/attendee emails, custom responses, and video-call passwords.
Affected Products
- Cal.com (open-source self-hosted distribution)
- Cal.com team and organization workspaces exposing webhook management APIs
- Deployments derived from the calcom/cal.diy codebase
Discovery Timeline
- 2026-07-22 - CVE-2026-16624 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-16624
Vulnerability Analysis
Cal.com exposes a webhook subscription API that accepts a teamId field in the request body. The endpoint verifies that the caller is authenticated but does not verify that the caller is a member of the referenced team. This is a missing authorization check on a tenant-scoping identifier, mapping to broken access control patterns such as [CWE-862] Missing Authorization and [CWE-639] Authorization Bypass Through User-Controlled Key.
Because the webhook is stored against the injected teamId, subsequent booking events on that team trigger delivery of the event payload to the attacker's URL. The payload includes booking metadata that Cal.com forwards to legitimate integrations: organizer email, attendee email, custom booking fields, and, when the booking uses an integrated video conferencing location, the meeting password.
Root Cause
The root cause is an unvalidated tenant identifier on a state-changing endpoint. The controller trusts the client-supplied teamId and skips a membership or role check against the authenticated principal. Ownership is assumed rather than enforced, so the persistence layer records a webhook attached to a team the caller has no relationship with.
Attack Vector
An attacker registers or uses an existing Cal.com account on a self-hosted or shared instance. The attacker sends an authenticated request to the webhook creation endpoint with a teamId belonging to a victim team and a subscriberUrl pointing to attacker-controlled infrastructure. The attacker subscribes to booking event types such as BOOKING_CREATED. When any user books time with the victim team, Cal.com serializes the booking payload and delivers it to the attacker's endpoint over HTTP.
No verified proof-of-concept code is published in the referenced advisories. See the GitHub Security Advisory and the Voke Cyber Research Report for technical detail.
Detection Methods for CVE-2026-16624
Indicators of Compromise
- Webhook records in the Cal.com database whose teamId does not match any team the creating user belongs to.
- Outbound webhook deliveries to newly registered domains or IP addresses not present in prior configuration baselines.
- Webhook subscriberUrl values pointing to raw IP addresses, dynamic DNS providers, or request-catcher services.
- Unexpected WEBHOOK_CREATED audit events initiated by low-privilege user accounts.
Detection Strategies
- Query the webhook table for entries where userId is not a member of the associated teamId, and flag any mismatch for review.
- Alert on webhook creation events originating from accounts that have no administrative role in the target team.
- Inspect application logs for POST requests to webhook management routes that include a teamId field, correlating the caller identity with team membership.
Monitoring Recommendations
- Forward Cal.com application and audit logs to a central log store and retain webhook lifecycle events for at least 90 days.
- Monitor egress traffic from the Cal.com host for HTTP callbacks to unapproved destinations and enforce an allowlist where feasible.
- Track baseline counts of webhooks per team and alert on sudden increases, especially outside change-management windows.
How to Mitigate CVE-2026-16624
Immediate Actions Required
- Upgrade Cal.com to the fixed release identified in the vendor advisory before restoring normal operations.
- Enumerate all webhooks across teams and delete any whose creator is not a current member of the target team.
- Rotate any video-call passwords, meeting links, and shared secrets that may have been transmitted through webhook payloads.
- Notify attendees whose booking data may have been exfiltrated in line with applicable breach disclosure obligations.
Patch Information
Cal.com maintainers have published a security advisory at GHSA-4fwh-xxpv-xfm6. Administrators of self-hosted deployments should apply the fixed version referenced in that advisory. The fix enforces authorization on the teamId parameter so that only members with sufficient role on the target team can create webhooks.
Workarounds
- Restrict the webhook management endpoints at the reverse proxy or WAF layer to administrator source ranges until the patch is applied.
- Disable self-service account registration on shared Cal.com instances to reduce the population of authenticated attackers.
- Introduce a database-level constraint or scheduled job that removes webhooks whose creator lacks membership on the referenced team.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
