Cal.com Broken Access Controls Exposes Millions of Bookings and Leads to Complete Account Takeover
Cal.com, an open-source scheduling platform, recently addressed a significant security vulnerability identified on January 26, 2026. The issue could potentially allow unauthorized access to user accounts and sensitive booking information.
Cal.com, an open-source scheduling platform, recently addressed a significant security vulnerability identified on January 26, 2026. The issue could potentially allow unauthorized access to user accounts and sensitive booking information.
The vulnerability in Cal.com Cloud was a result of three interconnected security flaws. These flaws were found in the platform's signup process and booking data endpoints, which, when combined, enabled attackers to gain unauthorized access to user accounts. This access exposed private meeting details, attendee information, and complete booking histories.
Gecko Security analysts utilized an AI-powered security analysis tool to identify these vulnerabilities within the Cal.com codebase. Their investigation demonstrated how subtle bugs in core components could be exploited sequentially, affecting both administrative and regular user accounts.
Technical Details of the Authentication Bypass
The most critical flaw was an authentication bypass using organization invite tokens. This bypass was due to a faulty username validation function, which failed to verify if an email address was already registered. Consequently, the system erroneously approved signups for existing users, allowing unauthorized access.
Cal.com, an open-source scheduling platform, recently addressed a significant security vulnerability identified on January 26, 2026.
The signup validation incorrectly bypassed security checks for users already in organizations. Email validation was limited to the attacker's organization, overlooking users in other organizations. The database operation overwrote the victim's password with the attacker's chosen credentials.
Attackers could exploit this by generating an invite link, entering a victim's email, and setting a new password, gaining full account access without notifying the account owner. Cal.com has since patched this issue in version 6.0.8 by implementing proper user existence checks before signup.
A second vulnerability involved Insecure Direct Object References on API endpoints. This flaw allowed authenticated users to access and modify all bookings on the platform. Cal.com has restricted access to these internal routes and implemented fixes promptly.
Based on reporting by Cyber Security News.