CVE-2026-16624
Received Received - Intake

Cal.com Webhook TeamID Authorization Bypass Leading to Sensitive Data Exposure

Publication date: 2026-07-22

Last updated on: 2026-07-22

Assigner: CERT/CC

Description
Cal.com OSS ships lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-22
Last Modified
2026-07-22
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-16624
EUVD
EUVD-2026-47769

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cal.com cal.com *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-16624 is a critical authorization bypass flaw in Cal.com that allows any authenticated user to create a webhook on another team by injecting an unvalidated teamId parameter. This enables attackers to attach malicious webhooks to victim teams without permission, leading to unauthorized data exposure.

Detection Guidance

Check for unauthorized webhooks by querying the webhook table for mismatches between the owning user and team. Review subscriber URLs for unfamiliar destinations. Look for unexpected booking data forwarding to unknown endpoints.

Impact Analysis

This vulnerability allows attackers to steal sensitive booking data, including organizer and attendee emails, phone numbers, custom responses, and video-call passwords. All bookings made after the malicious webhook is planted are silently forwarded to an attacker-controlled server without the victim's knowledge.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized processing and exposure of personal data, and HIPAA if healthcare-related bookings are affected. It results in high confidentiality loss and potential regulatory fines for exposed PII.

Mitigation Strategies

Audit the webhook table for unauthorized entries. Rotate exposed data like video-call passwords and PII. Consider disabling webhook creation until a patch is available. Monitor for suspicious API calls to the viewer.webhook.create endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16624. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart