What’s Vulnerable › Vulnerabilities

CVE-2026-9349: calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-24 · updated 2026-07-23
• Weakness: CWE-200

Description

A vulnerability was determined in calcom cal.diy up to 4.9.4. Affected by this issue is the function getServerSideProps of the file apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the component Generic React API. This manipulation of the argument cancelledBy/rescheduledBy causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

• calcom cal.diy: 4.9.0, 4.9.1, 4.9.2, 4.9.3, 4.9.4

References

• https://gist.github.com/YLChen-007/b59c44d1550c4b0f373ca4eb1c150994
• https://vuldb.com/submit/812177
• https://vuldb.com/vuln/365312
• https://vuldb.com/vuln/365312/cti

Get alerted when CVE-2026-9349 or the next vulnerability affects your stack