PT-2026-42905 · Cal.Com · Cal.Com

Eric-Z · Published 2026-05-24 · Updated 2026-05-24 · CVE-2026-9349

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions calcom cal.diy versions prior to 4.9.5

Description An information disclosure issue exists in the Generic React API component. The problem resides in the getServerSideProps() function within the file apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx. A remote attacker can trigger this by manipulating the cancelledBy or rescheduledBy arguments.

Recommendations Update to a version later than 4.9.4. As a temporary workaround, restrict access to the getServerSideProps() function in the affected file to minimize the risk of information disclosure.

Exploit

Fix

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

CVE-2026-9349

Affected Products

Cal.Com

References · 7

• 🔥 https://gist.github.com/YLChen-007/b59c44d1550c4b0f373ca4eb1c150994 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-9349 · Security Note
• https://vuldb.com/submit/812177 · Note
• https://twitter.com/CVEnew/status/2058530625754406998 · Twitter Post
• https://vuldb.com/vuln/365312/cti · Note
• https://t.me/CVEtracker/54744 · Telegram Post
• https://vuldb.com/vuln/365312 · Note