A chain of critical vulnerabilities in Cal.com, an open-source scheduling infrastructure used by developers and enterprises worldwide.
The flaws, rooted in logic errors in the signup flow and misconfigured Next.js routing, allowed attackers to bypass authentication entirely.
Successful exploitation enabled unauthorized actors to overwrite the passwords of existing users, resulting in complete account takeover (ATO) and access to sensitive booking details, including private meeting metadata and attendee PII. Cal.com has since patched these issues in version 6.0.8.
The Logic Flaw: Account Takeover via Invite Tokens
The most severe vulnerability was an authentication bypass located in the organization signup process.
It allowed an attacker to hijack any user account simply by knowing the victim’s email address and utilizing a valid organization invite token.
Faulty Username Validation: The function usernameCheckForSignup was designed to check if a user already exists.
However, the logic contained a conditional check that skipped validation if the target user was already a member of an organization.
If userIsAMemberOfAnOrg returned true, the system defaulted to available: true, incorrectly signaling that the signup process could proceed.
Scoped Database Queries: The secondary validation step checked for existing users but restricted the scope to the attacker’s organization ID.
When the code executed prisma. user.findFirst first checked whether the email existed within that specific organization. If the victim belonged to a different organization, the query returned null, further validating the fraudulent signup attempt.
The Global Upsert Overwrite: The final step involved a prisma. user.upsert operation. Because email addresses are globally unique in the Cal.com database schema.
The upsert command matched the victim’s existing record. Instead of creating a new user, it executed the update block.
Impact: The update operation overwrote the victim’s password hash with one provided by the attacker and moved the victim’s account into the attacker’s organization.
API Exposure via Next.js Routing
A second critical vulnerability involved Insecure Direct Object References (IDOR) and improper route handling in the application’s API v1.
Cal.com utilizes underscore-prefixed files (e.g., _get.ts, _post.ts, _delete.ts) as internal route handlers.
The primary entry point, index.ts, correctly implemented authorization middleware to secure these handlers.
However, the Next.js framework exposed the internal underscore files as directly accessible public routes.
By bypassing index.ts and sending requests directly to endpoints such as _/get, attackers could circumvent all authorization checks. This exposure allowed authenticated users with a valid API key to:
- Read all bookings: Access meeting details, attendee emails, and descriptions across the platform.
- Delete data: Erase bookings and destination calendars by ID, silently breaking routing rules.
| Component | Vulnerability Type | Severity | Technical Root Cause |
|---|---|---|---|
| Signup Flow | Broken Access Control / ATO | Critical | prisma.user.upsert logic overwrote existing credentials due to improper scope validation. |
| API v1 | Authentication Bypass | High | Internal Next.js handlers (_get.ts) exposed as public routes, bypassing middleware in index.ts. |
| Org Logic | Logic Error | High | usernameCheckForSignup skipped validation for existing organization members. |
The Cal.com team responded swiftly to the disclosure. The account takeover chain was resolved in v6.0.8 by enforcing strict user existence validation before processing signups with invite tokens, according to an external disclosure from Gecko Security.
The API exposure was mitigated by updating the Next.js middleware. The patch now explicitly blocks external access to internal route handlers (paths beginning with /_), returning a 403 Forbidden status for any direct requests to these files.
Users self-hosting Cal.com are strongly advised to upgrade to the latest version immediately to mitigate these risks. Cloud-hosted instances have already been patched.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
