External risk intelligence

Cal.com OSS Webhook Team ID Creation Vulnerability Allows Data Theft.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-16624

Cal.com is a web-based scheduling platform commonly deployed as a public-facing service. The vulnerability exists within the application's webhook management functionality, which is accessible to authenticated users over the network in standard internet-facing web deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Cal.com OSS allows authenticated users to create webhooks on any team, potentially exposing sensitive booking data such as attendee emails and custom responses. This could also grant access to video-call passwords, impacting data privacy and system integrity.

Unauthorized webhook creation exposes booking data.
Crucial to verify if your teams are affected.
Confirming relevance and exposure is the priority.

Attack Path

How an attacker could exploit the issue

An attacker with existing access to Cal.com can exploit a flaw in how the system handles webhook creation. By leveraging an unvalidated team ID, they can set up a webhook for any team, including those they don't belong to. Once this webhook is established, triggering its delivery allows the attacker to access sensitive booking information and potentially video-call credentials.

Authenticated user access required.
Unvalidated team ID injection.
Steal booking data and credentials.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow any authenticated user to create a webhook for any team, potentially leading to the theft of sensitive booking information. This includes organizer and attendee email addresses, custom responses, and, under certain conditions, video-call passwords, by triggering the delivery of these webhooks.

Booking data and PII at risk.
Authenticated users can inject team IDs.
Booking details and meeting credentials may be stolen.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for addressing this authorization vulnerability in Cal.com OSS, as it impacts data integrity and potentially leads to data exfiltration. The immediate priority is to identify all instances of the affected technology, confirm their exposure and business criticality, and then locate the accountable owner to plan a risk-based remediation strategy.

Confirm application ownership and deployment scope.
Verify if any team webhooks are externally accessible.
Plan remediation based on confirmed exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cal.com OSS?

Cal.com OSS is an open-source scheduling infrastructure platform. It is widely used by organizations to manage appointments and meetings through a web interface, allowing teams to automate booking workflows, handle calendar integrations, and coordinate video conferencing credentials for participants.

How does CVE-2026-16624 work?

This vulnerability is an Authorization Bypass, classified as CWE-639. It occurs because the system fails to verify if a user has permission to manage webhooks for a specific team. An attacker can inject a team ID they do not own, allowing them to intercept sensitive booking data like attendee emails or video-call passwords that should be restricted to authorized team members.

What triggers this webhook vulnerability?

The flaw is triggered when an authenticated user performs a webhook creation action while providing an unvalidated team ID. It is not triggered by anonymous, unauthenticated visitors; the attacker must already have a valid user account within the platform to interact with the webhook creation API and inject the unauthorized team identifier.

Is my Cal.com instance at risk?

According to Halo Surface Signal, this vulnerability is most relevant if your instance is internet-facing, as it is a common deployment model for this scheduling platform. Because the attack occurs over the network via authenticated API requests, any public-facing Cal.com installation where users can manage webhooks should be considered a potential target for unauthorized data access.

How should I respond to CVE-2026-16624?

Begin by identifying all instances of Cal.com OSS within your environment and verifying who owns each deployment. Assess which instances are reachable from the network and review existing team webhook configurations for unauthorized entries. Engage your application teams to prioritize these findings and prepare to implement the authorized fixes once they are available.

References

vokecyber.com/research/calcom-cross-tenant-webhook-plant

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.