Notifications
Clear all
Topic starter
02/08/2026 12:05 pm
TL;DR: Chained vulnerabilities in Cal.com Cloud enabled complete account takeover and access to bookings, attendee metadata, OAuth tokens, API keys, and calendar integrations before patches landed, according to Gecko Security. The case reinforces that broken access control is still a programme-level risk, not a single bug to patch in isolation.
NHIMG editorial — based on content published by Gecko Security: Cal.com account takeover through chained access-control flaws
Questions worth separating out
Q: What breaks when signup validation can be bypassed in a multi-tenant app?
A: A bypass in signup validation can let an attacker overwrite an existing account instead of creating a new one.
Q: Why do broken access controls create such large identity risks?
A: Because access control is often the last boundary between a user’s session and the records that define account ownership, authentication state, and data visibility.
Q: How do security teams find object-level authorization failures?
A: They need to test every method and route variant against the same record under different users, tenants, and roles.
Practitioner guidance
- Map credential-changing code paths end to end Trace every signup, reset, invite, and upsert path to confirm that an existing verified identity cannot be overwritten by a new request in any tenant context.
- Enforce global identity checks before tenant checks Treat verified email existence, username ownership, and account recovery as global identity properties before applying any organization-scoped logic.
- Block direct access to internal handlers Add routing and middleware tests for underscore-prefixed or internal endpoints so direct requests cannot bypass authorization middleware.
What's in the full article
Gecko Security's full post covers the operational detail this post intentionally leaves for the source:
- Line-by-line exploit chains for the signup bypass and account overwrite path
- Code excerpts showing where org-scoped validation diverged from global identity checks
- Request-path and middleware details for the exposed internal route handlers
- Patch notes and the specific fix Cal.com applied in v6.0.8
👉 Read Gecko Security's analysis of the Cal.com account takeover chain →
Cal.com account takeover: what broken access control means for teams?
Explore further
02/08/2026 1:10 pm
Broken access control becomes identity compromise when the same user record can be both identity proof and overwrite target. The Cal.com chain shows that authorization failures are not isolated application defects when they can alter passwords, organization membership, and session trust in one transaction. For identity teams, the practical conclusion is that account state changes need the same control scrutiny as login itself.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who is accountable when account takeover happens through a chained application flaw?
A: Accountability usually spans application owners, platform engineers, and identity governance leads, because the failure crosses authentication, authorization, and persistence layers. Frameworks such as the NIST Cybersecurity Framework and OWASP guidance make clear that identity controls must be enforced consistently across the full request path, not only at login.
👉 Read our full editorial: Cal.com account takeover exposes the cost of broken access control
