Medium severity · published May 24, 2026
CVE-2026-9349
calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was determined in calcom cal.diy up to 4.9.4. Affected by this issue is the function getServerSideProps of the file apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the component Generic React API. This manipulation of the argument cancelledBy/rescheduledBy causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
cal.diy · calcom
4.9.0; 4.9.1; 4.9.2; 4.9.3; 4.9.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9349
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9349
gist.github.com
https://gist.github.com/YLChen-007/b59c44d1550c4b0f373ca4eb1c150994
vuldb.com
https://vuldb.com/submit/812177
vuldb.com
https://vuldb.com/vuln/365312
vuldb.com
https://vuldb.com/vuln/365312/cti
More from cal.diy
10.0
CVE-2025-71389
Cal.com before 5.9.9 Remote Code Execution via RSC
9.9
CVE-2024-58354
cal.com Repository Takeover via pull_request_target Workflow
8.9
CVE-2024-58355
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
8.9
CVE-2024-58353
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
6.3
CVE-2026-112043
calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization