A weakness exists in the createWebhookProcedure function of the Webhook Handler in cal.com and cal.diy packages up to version 6.2.0. An attacker can manipulate the ID argument to bypass normal authorization checks, effectively allowing them to perform actions normally reserved for authorized users. This vulnerability is a classic example of missing authorization controls and user-controlled key-based access bypass, as reflected by the associated CWE identifiers. The effect of successful exploitation is unauthorized access to webhook functionality, which may lead to unintended data exposure, tampering, or creation of malicious webhooks.

The vulnerability impacts Cal.com (cal.com) and the DIY variant (cal.diy) of the Cal.com platform. All releases up to and including version 6.2.0 are affected. The specific vulnerability resides in the file packages/trpc/server/routers/viewer/webhook/util.ts within the Webhook Handler component.

The CVSS score of 5.3 classifies the issue as medium severity, and the EPSS score is not available, indicating no publicly documented exploitation at the time of assessment. The vulnerability is not listed in CISA's KEV catalog. Attackers can launch the exploit remotely by sending crafted requests to the webhook creation endpoint. Because the flaw arises from insufficient server-side authorization checks, the risk is elevated for systems that expose the endpoint to untrusted traffic. Until a patch is released, administrators should be aware of the potential for unauthorized webhook manipulation.