CVE-2026-109143 | calcom cal.com/cal.diy up to 6.2.0 Credentials delete credentials.delete teamId privileges management

October 12, 2026 Yanac

A vulnerability has been found in calcom cal.com and cal.diy up to 6.2.0 and classified as problematic. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege management.

This vulnerability is handled as CVE-2026-109143. The attack can be initiated remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More