CVE-2026-112043

CVE-2026-112043 · calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

CVSS 5.3 · Medium · EPSS 0.3%

Published: 2026-10-19T02:30:14.914Z
Updated: 2026-10-19T16:36:31.150Z

Affected products and versions

cal.com
Versions
- 6.0: Affected
- 6.1: Affected
- 6.2.0: Affected
No fix published
cal.diy
Versions
- 6.0: Affected
- 6.1: Affected
- 6.2.0: Affected
No fix published

Original sources

https://vuldb.com/vuln/421691
https://vuldb.com/vuln/421691/cti
https://vuldb.com/cve/CVE-2026-112043
https://vuldb.com/submit/1009017
https://github.com/calcom/cal.diy/issues/29982
https://github.com/calcom/cal.diy/pull/30223
https://nvd.nist.gov/vuln/detail/CVE-2026-112043

Check your server →