Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-109143: cal.com can let remote users delete others' credentials
CVE-2026-109143 · published 5 days ago
Summary
Versions of cal.com and cal.diy up to 6.2.0 let an attacker change a team identifier in a delete‑request API and remove credential records that belong to other teams. This can be done over the network and may cause loss of access for legitimate users. Apply the vendor’s update or any available patch, and limit who can call the delete endpoint while monitoring for unusual delete activity.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| calcom | cal.com | 6.0 |
| calcom | cal.diy | 6.0 |
Original advisory text
calcom cal.com/cal.diy Credentials delete credentials.delete privileges management
A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege management. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-266Incorrect Privilege Assignment
CWE-269Improper Privilege Management
Timeline
Published13 Oct 2026
Updated17 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta