CVE-2026-109143 Details
Description
A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege management. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability exists in Calcom's Cal.com and Cal.diy versions up to 6.2.0, within the Credentials Handler component. The issue arises in the credentials.delete function of the /api/trpc/credentials/delete endpoint, where the teamId argument is manipulated, leading to improper privilege management. This vulnerability allows any authenticated user to delete another team's connected integrations, including calendars, video, and payment applications. Exploitation can be done by enumerating valid teamId and credential id pairs and sending requests to delete credentials in bulk.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/k4z01/7f7739e59ae595f7bdd45922adf2b547 | [email protected] | ExploitTechnical Description |
| https://vuldb.com/cve/CVE-2026-109143 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/978033 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416882 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416882/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| calcom cal.com | <= 6.2.0 (semver) |
CPE
Remediation
| |
| calcom cal.diy | <= 6.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |