Topic starter
02/08/2026 12:05 pm
TL;DR: Chained vulnerabilities in Cal.com Cloud enabled complete account takeover and access to bookings, attendee metadata, OAuth tokens, API keys, and calendar integrations before patches landed, according to Gecko Security. The case reinforces that broken access control is still a programme-level risk, not a single bug to patch in isolation.
Editorial analysis by NHI Mgmt Group, based on content published by Gecko Security: “How Broken Access Controls in Cal.com Leaked Millions of Bookings and Enabled Complete Account Takeover”.
By the numbers:
- Cal.com had nearly 1,000 contributors and aims to connect 1 billion people by 2031, according to Gecko Security.
Key questions
Q: What breaks when signup logic treats an existing account as available?
A: When signup logic can mistake an existing verified account for a new one, an attacker can overwrite credentials, reassign tenant membership, and inherit the victim's access.
Q: Why do scoped validation and global uniqueness create takeover risk?
A: Because the validator and the database are answering different security questions.
Q: What are the signs that route-level authorization is failing?
A: Look for internal handlers, fallback routes, or framework-generated endpoints that behave differently from the main controller path.
Practitioner guidance
- Harden signup and invite workflows Require explicit existence checks before any signup path can create or overwrite an account tied to a verified email address.
- Align tenant checks with write operations Test whether the same tenant scoping logic that gates lookup also protects the database upsert or update that finalises the change.
- Protect internal handlers as public routes Audit framework-generated or underscore-prefixed endpoints as if they were user-facing APIs, and confirm that middleware cannot be bypassed by alternate path access.
Bottom line: The incident shows that broken access control can cascade from a single signup flaw into full account takeover and broad data exposure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:10 pm
Broken access control becomes systemic when identity checks disagree across layers: The Cal.com case shows how signup logic, tenancy scoping, and route authorization can each appear defensible in isolation while failing together. That is not a point defect but a control architecture failure. Practitioners should read it as evidence that authorization must be consistent from user entry point to database write path, or the stack will inherit the weakest decision.
A question worth separating out:
Q: How should teams test for account takeover paths in multi-tenant apps?
A: Test every workflow that can alter identity state, including signup, invite acceptance, password reset, and organisation transfer, against an account that already exists in another tenant. The point is to prove that no path can overwrite credentials or ownership without explicit authorization. If one path succeeds, the identity boundary is too weak.
👉 Read our full editorial: Cal.com account takeover exposes the cost of broken access control