CVE-2026-9349

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-9349", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-05-23T09:12:41.757Z", "datePublished": "2026-05-24T02:30:11.039Z", "dateUpdated": "2026-05-26T13:37:06.325Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-24T02:30:11.039Z"}, "title": "calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-200", "lang": "en", "description": "Information Disclosure"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}], "affected": [{"vendor": "calcom", "product": "cal.diy", "versions": [{"version": "4.9.0", "status": "affected"}, {"version": "4.9.1", "status": "affected"}, {"version": "4.9.2", "status": "affected"}, {"version": "4.9.3", "status": "affected"}, {"version": "4.9.4", "status": "affected"}], "cpes": ["cpe:2.3:a:calcom:cal.diy:*:*:*:*:*:*:*:*"], "modules": ["Generic React API"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in calcom cal.diy up to 4.9.4. Affected by this issue is the function getServerSideProps of the file apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the component Generic React API. This manipulation of the argument cancelledBy/rescheduledBy causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-05-23T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-05-23T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-05-23T11:17:45.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Eric-z (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/365312", "name": "VDB-365312 | calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/365312/cti", "name": "VDB-365312 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/812177", "name": "Submit #812177 | cal.com <= v4.9.4 Exposure of Sensitive Information (CWE-200)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/YLChen-007/b59c44d1550c4b0f373ca4eb1c150994", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-26T13:36:59.813179Z", "id": "CVE-2026-9349", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T13:37:06.325Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-9349", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T13:36:59.813179Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-26T13:37:03.095Z"}}], "cna": {"title": "calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure", "credits": [{"lang": "en", "type": "reporter", "value": "Eric-z (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:calcom:cal.diy:*:*:*:*:*:*:*:*"], "vendor": "calcom", "modules": ["Generic React API"], "product": "cal.diy", "versions": [{"status": "affected", "version": "4.9.0"}, {"status": "affected", "version": "4.9.1"}, {"status": "affected", "version": "4.9.2"}, {"status": "affected", "version": "4.9.3"}, {"status": "affected", "version": "4.9.4"}]}], "timeline": [{"lang": "en", "time": "2026-05-23T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-05-23T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-05-23T11:17:45.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/365312", "name": "VDB-365312 | calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/365312/cti", "name": "VDB-365312 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/812177", "name": "Submit #812177 | cal.com <= v4.9.4 Exposure of Sensitive Information (CWE-200)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/YLChen-007/b59c44d1550c4b0f373ca4eb1c150994", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in calcom cal.diy up to 4.9.4. Affected by this issue is the function getServerSideProps of the file apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the component Generic React API. This manipulation of the argument cancelledBy/rescheduledBy causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "Information Disclosure"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-05-24T02:30:11.039Z"}}}, "cveMetadata": {"cveId": "CVE-2026-9349", "state": "PUBLISHED", "dateUpdated": "2026-05-26T13:37:06.325Z", "dateReserved": "2026-05-23T09:12:41.757Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-05-24T02:30:11.039Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:calcom:cal.diy:*:*:*:*:*:*:*:*"], "modules": ["Generic React API"], "product": "cal.diy", "vendor": "calcom", "versions": [{"status": "affected", "version": "4.9.0"}, {"status": "affected", "version": "4.9.1"}, {"status": "affected", "version": "4.9.2"}, {"status": "affected", "version": "4.9.3"}, {"status": "affected", "version": "4.9.4"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was determined in calcom cal.diy up to 4.9.4. Affected by this issue is the function getServerSideProps of the file apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the component Generic React API. This manipulation of the argument cancelledBy/rescheduledBy causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Se determin\u00f3 una vulnerabilidad en calcom cal.diy hasta la versi\u00f3n 4.9.4. Afectada por este problema est\u00e1 la funci\u00f3n getServerSideProps del archivo apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx del componente Generic React API. Esta manipulaci\u00f3n del argumento cancelledBy/rescheduledBy causa revelaci\u00f3n de informaci\u00f3n. El ataque puede iniciarse remotamente. El exploit ha sido divulgado p\u00fablicamente y puede ser utilizado. Se contact\u00f3 al proveedor con antelaci\u00f3n sobre esta divulgaci\u00f3n, pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-9349", "lastModified": "2026-07-23T11:10:00.120", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9349", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-26T13:36:59.813179Z", "version": "2.0.3"}}]}, "published": "2026-05-24T04:16:59.957", "references": [{"source": "cna@vuldb.com", "url": "https://gist.github.com/YLChen-007/b59c44d1550c4b0f373ca4eb1c150994"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/812177"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/365312"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/365312/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.9.4"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "cal.diy", "source": "cna", "vendor": "calcom"}, "product": "cal.diy", "vendor": "calcom"}], "created": "2026-05-24T04:30:34.955449+00:00", "updated": "2026-05-24T06:00:12.385238+00:00", "vendors": ["calcom", "calcom$PRODUCT$cal.diy"]}