MEDIUM 5.3 NVD
CVE-2026-112043
A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/route
A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.
References
- https://github.com/calcom/cal.diy/issues/29982
- https://github.com/calcom/cal.diy/pull/30223
- https://vuldb.com/cve/CVE-2026-112043
- https://vuldb.com/submit/1009017
- https://vuldb.com/vuln/421691
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-19 via NVD.
vulnfeed aggregates 17234 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.