CVE-2026-112043: calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-19 · updated 2026-10-19
Weakness: CWE-285

Description

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

Affected products

calcom cal.com: 6.0, 6.1, 6.2.0
calcom cal.diy: 6.0, 6.1, 6.2.0

References

https://github.com/calcom/cal.diy/issues/29982
https://github.com/calcom/cal.diy/pull/30223
https://vuldb.com/cve/CVE-2026-112043
https://vuldb.com/submit/1009017
https://vuldb.com/vuln/421691
https://vuldb.com/vuln/421691/cti
https://github.com/calcom/cal.diy/issues/29982

Get alerted when CVE-2026-112043 or the next vulnerability affects your stack