TI-2026-08199 Aliases CVE-2026-9349 GHSA-23fj-h8hh-93x3

calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure

HIGH 70CWE-200Published 2026-05-24 · Updated 2026-05-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200 and CWE-284.

Summary

A vulnerability was determined in calcom cal.diy up to 4.9.4. Affected by this issue is the function getServerSideProps of the file apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the component Generic React API. This manipulation of the argument cancelledBy/rescheduledBy causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.0041 35th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
calcom	cal.diy	4.9.0; 4.9.1; 4.9.2; 4.9.3; 4.9.4	—	No fix listed	CNA

cal.diy Vendorcalcom Affected 4.9.0; 4.9.1; 4.9.2; 4.9.3; 4.9.4 Fixed in — No fix listed CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:calcom:cal.diy::::::::	—	—	—

cpe:2.3:a:calcom:cal.diy:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-9349
2026-10-03 Alias added: GHSA-23fj-h8hh-93x3

References

Exploit 1

https://gist.github.com/YLChen-007/b59c44d1550c4b0f373ca4eb1c150994

TI-2024-38439 Cal.com through 4.7.15 Cross-Site Scripting via booking questions CVSS 4.0CRITICAL 9.3
TI-2024-38437 Cal.com through 4.7.15 Cross-Site Scripting via booking questions CVSS 4.0CRITICAL 9.3
TI-2024-38438 cal.com Repository Takeover via pull_request_target Workflow CVSS 4.0HIGH 8.5
TI-2023-19352 Cal.com not expiring old sessions after enabling 2FA CVSS 3.1MEDIUM 6.5
TI-2026-76231 Authorization bypass in cal.com and cal.diy webhook handler CVSS 4.0MEDIUM 5.3
TI-2026-71619 Improper privilege management in Cal.com credential deletion CVSS 4.0MEDIUM 5.3

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences