Cal.com Broken Access Controls Lead to Account Takeover and Data Exposure

Gecko discovered and reported critical broken access control vulnerabilities in Cal.com: an authentication bypass in the organization signup flow that enabled account takeover using only an email and invite link, and misconfigured Next.js internal API routes that exposed and allowed deletion of booking and calendar data across organizations. Cal.com patched the issues (v6.0.8 and middleware updates) after disclosure; the flaws could expose PII, OAuth tokens, API keys, and allow silent lockout of users.