CVE-2026-9349
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Vulnerability in calcom cal.diy up to version 4.9.4. The getServerSideProps function in apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the Generic React API component causes information disclosure via manipulation of cancelledBy/rescheduledBy arguments. The attack can be initiated remotely and the exploit is publicly available.
Risk Assessment
The organization is at risk of sensitive data leakage from the booking system. Public exploit availability increases the likelihood of rapid exploitation.
Recommendation
Update calcom cal.diy to the latest available version. If not available, restrict API access and monitor for suspicious requests.
Other vulnerabilities in calcom cal.diy
See all- CVE-2026-104054Medium
A security flaw has been discovered in calcom cal.diy up to 6.2.0. It affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used. The pull request to fix this issue awaits acceptance.
- CVE-2026-9303Medium
A CSRF vulnerability has been identified in calcom cal.diy up to version 4.9.4. An unknown function allows CSRF attacks that can be initiated remotely. The exploit is publicly available. The vendor did not respond.
Original NVD description (English source)
A vulnerability was determined in calcom cal.diy up to 4.9.4. Affected by this issue is the function getServerSideProps of the file apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the component Generic React API. This manipulation of the argument cancelledBy/rescheduledBy causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS