CVE-2026-109143 calcom CVE debrief

Who should care

Defenders responsible for cal.com and cal.diy deployments should assess exposure and prioritize remediation based on the vendor guidance provided in the official CVE record and NVD vulnerability detail. This includes verifying versions in use, assessing exposure to improper privilege management, and applying remediation to prevent potential exploitation.

Why it matters

Defenders should prioritize verifying versions, assessing exposure, and applying remediation for CVE-2026-109143 affecting cal.com and cal.diy up to 6.2.0.

• Verify versions of cal.com and cal.diy in use
• Assess exposure to improper privilege management
• Prioritize remediation based on vendor guidance
• Monitor for potential exploitation attempts

Technical summary

The vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler in calcom cal.com and cal.diy up to 6.2.0. The manipulation of the argument teamId causes improper privilege management. This vulnerability can be exploited remotely, allowing attackers to manipulate credentials without proper authorization. Defenders should prioritize verifying the versions of cal.com and cal.diy in use, assessing exposure, and applying vendor remediation if available.

Defensive priority

Defenders should prioritize verifying the versions of cal.com and cal.diy in use, assessing exposure, and applying vendor remediation if available.

Recommended defensive actions

• Verify the versions of cal.com and cal.diy in use
• Assess exposure to the vulnerability
• Apply vendor remediation if available
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE Program record and NVD vulnerability detail provide official information about the vulnerability. Supplemental sources, including VulDB entries, offer additional context. Defenders should verify versions of cal.com and cal.diy in use, assess exposure to improper privilege management, and prioritize remediation based on vendor guidance. The exploit has been publicly disclosed and may be utilized.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.