A flaw in the credentials.delete API endpoint of Calcom’s cal.com and cal.diy platforms allows an attacker to manipulate the teamId argument and delete credentials that belong to other teams, leading to improper privilege management. Based on the description, this vulnerability constitutes an authorization bypass through privilege escalation (CWE-266) and improper privilege management (CWE-269). The impact is the loss of authentication tokens or credentials for third‑party services, potentially exposing confidential data to unauthorized users.

All releases of Calcom’s cal.com and cal.diy products up to and including version 6.2.0 are affected. The vulnerability resides in the Credentials Handler component exposed at /api/trpc/credentials/delete and exploits the ability to alter the teamId field when sending a delete request.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, implying the exploitation probability is unknown. The vulnerability can be triggered remotely via the web API, and public disclosures suggest that attackers may already be using it. The CISA KEV catalog does not list this issue, but the public nature of the exploit and the remote attack vector raise the risk of additional exploitation.