Cal.com Broken Access Controls Lead to Account Takeover and Data Exposure
Cal.com, an open-source scheduling platform, has addressed critical vulnerabilities that previously exposed user accounts and sensitive booking data to potential attackers.
Cal.com, an open-source scheduling platform, has addressed critical vulnerabilities that previously exposed user accounts and sensitive booking data to potential attackers.
The vulnerabilities, identified by Gecko's AI security team, allowed unauthorized account access and exposure of booking data, including private meetings and attendee information. These issues were identified through an AI-augmented static analysis platform, which uncovered complex vulnerability chains.
A significant vulnerability involved an authentication bypass in the organization signup process, which allowed attackers to take over existing accounts using an email address and an organization invite link. The vulnerability consisted of three logic flaws:
The usernameCheckForSignup function incorrectly validated existing organization members, allowing re-signup of active accounts. Validation checks were limited to the attacker's organization, ignoring global user existence. The signup handler executed a prisma.user.upsert() , overwriting the victim's account details and associating them with the attacker's organization.
These issues were identified through an AI-augmented static analysis platform, which uncovered complex vulnerability chains.
This issue was resolved in version 6.0.8 with enhanced user existence validation during signups via invite tokens.
Additional vulnerabilities exposed booking records and user data through misconfigured API routes and IDOR-style flaws. The API v1 routes were exposed due to routing misconfigurations in Next.js, allowing unauthorized data access and manipulation.
Access to attendee names, emails, and personal details. Exposure of meeting metadata and calendar information. Accessibility to complete booking histories across users and organizations.
Cal.com has updated its Next.js middleware to block unauthorized access to internal routes, returning HTTP 403 for direct requests.
The vulnerabilities highlighted the importance of robust access control and consistent authorization enforcement. Cal.com's response included implementing stricter global identity checks and refining framework routing behavior. This incident underscores the value of AI-augmented security tools in identifying complex vulnerability chains.
Based on reporting by GBHackers.