A flaw in Cal.com OSS’s Cal.diy component allows any authenticated user to create a webhook using an arbitrary teamId, bypassing the access control that should tie webhook ownership to a team. This lack of authorization means the attacker can set up a delegated webhook that triggers for every booking on the target team. When the webhook fires, it captures sensitive booking payloads such as organizer and attendee email addresses, custom responses, and occasionally video‑call passwords, giving the attacker direct access to confidential customer data. The weakness is a CWE‑639 authorization bypass through user‑controlled key.

The vulnerability affects installations of the open‑source Cal.com platform, specifically the Cal.diy module that handles webhook creation and delivery. Because the advisory does not list a particular version, all deployed Cal.com OSS builds that expose the webhook API or UI are vulnerable until a patch is applied. System administrators should verify whether their Cal.com deployment includes the Cal.diy component and whether webhook endpoints are publicly accessible.

The advisory assigns a high CVSS score of 9.6 and an EPSS score of <1%, indicating a high severity but low probability of exploitation at the time of this analysis. The vulnerability is not yet listed in CISA’s KEV catalog. Exploitation requires only standard authenticated user credentials; no elevated privileges or cross‑site scripting are needed. Once authenticated, the attacker can create a malicious webhook with a crafted teamId and harvest booking data with minimal effort, making discovery and execution straightforward for anyone with legitimate access.