CVE-2026-109143: Improper Privilege Management in calcom cal.com

This vulnerability affects the credentials.delete API endpoint in calcom cal.com and cal.diy versions 6.0, 6.1, and 6.2.0. Improper handling of the teamId parameter in the Credentials Handler component leads to improper privilege management, potentially allowing an attacker to perform unauthorized deletion of credentials. The vulnerability is remotely exploitable without requiring user interaction and has a CVSS 4.0 base score of 5.3 (medium severity). The vendor was notified but has not issued any response or patch. Public exploit information is available, increasing the risk of exploitation.

An attacker can remotely exploit this vulnerability to manipulate the teamId argument in the credentials.delete function, resulting in improper privilege management. This could allow unauthorized deletion of credentials, potentially impacting access control and security of the affected system. The vulnerability does not require user interaction and has a medium severity rating, indicating a moderate impact on confidentiality, integrity, or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should monitor for updates from the vendor. Until a patch is released, restrict access to the affected API endpoints and implement compensating controls such as strict access control policies and network-level restrictions to limit exposure.