PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9349 calcom CVE debrief

A medium-severity information disclosure vulnerability exists in calcom cal.diy versions up to 4.9.4. The vulnerability resides in the `getServerSideProps` function within `apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx`, where manipulation of the `cancelledBy` or `rescheduledBy` arguments can lead to unauthorized information disclosure. The attack vector is network-based, requires no authentication, and can be executed remotely. The exploit has been publicly disclosed, increasing the risk of active exploitation. The vendor was reportedly contacted prior to disclosure but did not respond.

Vendor
calcom
Product
cal.diy
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-24
Original CVE updated
2026-07-23
Advisory published
2026-05-24
Advisory updated
2026-07-23

Who should care

Organizations running calcom cal.diy instances up to version 4.9.4, particularly those exposing booking management interfaces to external users. Security teams should prioritize patching and input validation improvements.

Technical summary

The vulnerability exists in the server-side rendering path of a Next.js/React application. The `getServerSideProps` function in `bookings-single-view.getServerSideProps.tsx` fails to properly validate or authorize access when processing `cancelledBy` and `rescheduledBy` parameters. An unauthenticated remote attacker can manipulate these parameters to disclose information beyond their authorization scope. The CVSS 4.0 score of 5.5 reflects network accessibility with low confidentiality impact. The presence of a public exploit (disclosed via GitHub Gist) elevates practical risk despite medium severity scoring.

Defensive priority

medium

Recommended defensive actions

  • Upgrade calcom cal.diy to a version beyond 4.9.4 when a patched release becomes available
  • Review and validate input sanitization for cancelledBy and rescheduledBy parameters in getServerSideProps functions
  • Implement server-side validation to ensure users can only access their own booking cancellation and rescheduling data
  • Monitor application logs for anomalous access patterns to booking-related endpoints
  • Apply principle of least privilege to booking data access controls
  • Consider implementing additional authentication checks for sensitive booking operations

Evidence notes

Vulnerability identified in calcom cal.diy ≤4.9.4 via getServerSideProps function. CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, with low confidentiality impact. CWE-200 (Information Exposure) and CWE-284 (Improper Access Control) classified. Exploit publicly available per Vuldb submission.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9349 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9349

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9349 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9349

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.