CVE-2026-109143
Deferred Deferred - Pending Action

Improper Privilege Management in Cal.com and Cal.diy

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulDB

Description
A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege management. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109143
EUVD
EUVD-2026-98375

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
calcom cal.com 6.0
calcom cal.com 6.1
calcom cal.com 6.2.0
calcom cal.diy 6.0
calcom cal.diy 6.1
calcom cal.diy 6.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109143 is an improper privilege management flaw in calcom cal.com and cal.diy versions up to 6.2.0. The vulnerability exists in the /api/trpc/credentials/delete endpoint, where the teamId parameter can be manipulated to delete credentials without verifying if the requester belongs to the specified team. This allows any authenticated user to delete another team's integrations, including calendars, video, and payment apps.

Detection Guidance

Check for unauthorized deletions in the /api/trpc/credentials/delete endpoint logs. Monitor for HTTP 200 responses to DELETE requests with teamId parameters from users not part of the team. Use network traffic analysis to detect Burp Suite or similar tool usage targeting this endpoint.

Impact Analysis

An attacker could exploit this to delete another user's team credentials, including payment integrations which may cancel unpaid bookings and erase payment and attendee records. The attack is remote and requires only an authenticated user account. Attackers can enumerate valid teamId values and bulk-delete all team credentials on the instance.

Compliance Impact

This vulnerability could lead to unauthorized deletion of sensitive data, such as payment and attendee records, which may violate GDPR's data integrity and HIPAA's access controls. Improper privilege management risks unauthorized data exposure or destruction.

Mitigation Strategies

Upgrade cal.com or cal.diy to a version beyond 6.2.0 if available. Implement strict authorization checks to verify team membership before allowing credential deletions. Restrict access to the /api/trpc/credentials/delete endpoint to authorized users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109143. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart