Cal.com cal.diy CVE-2026-9349

Remote unauthenticated exploitation against default configurations of Cal.com cal.diy version 4.9.4 and below. The Generic React API with bookings single view functionality (getServerSideProps in bookings-single-view.getServerSideProps.tsx) must be accessible, which is standard in default deployments as this handles the public-facing booking interface. No special authentication, user interaction, or non-default configuration is required per the CVSS vector AV:N/AC:L/PR:N/UI:N. Exploitation is limited only by network accessibility to the cal.diy web interface, typically exposed on standard HTTP/HTTPS ports. The vulnerability specifically triggers when cancelledBy or rescheduledBy parameters are present in requests to the bookings endpoint, which is a normal API route in production cal.diy deployments.

Real-world risk is MODERATE despite the medium CVSS 5.3 score. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivially exploitable remote access requiring no authentication or user interaction, which typically elevates priority. However, the impact is limited to confidentiality with low severity (C:L/I:N/A:N), meaning disclosed information is constrained rather than comprehensive system compromise. The exploit maturity level (E:P for Proof-of-concept) confirms working public exploit code exists, significantly lowering the barrier to exploitation. EPSS data is not provided, but the combination of zero authentication requirements and public POC typically correlates with EPSS scores above 0.4-0.6. No CISA KEV listing indicates this is not yet observed in widespread active exploitation campaigns. The vendor's non-responsiveness (RL:X for remediation level unavailable from official source) is concerning as it forces organizations to self-patch from community sources or implement workarounds without vendor guidance. For organizations running cal.diy instances that handle sensitive booking data (healthcare appointments, executive calendars, paid consultations), this represents a privacy compliance risk. Attack complexity is low and automatable, making this suitable for mass scanning once attackers identify cal.diy installations.

An unauthenticated remote attacker identifies a cal.diy instance through Shodan or manual reconnaissance of booking platforms. Using the publicly available proof-of-concept from GitHub Gist, the attacker crafts HTTP requests to the bookings single view API endpoint with manipulated cancelledBy or rescheduledBy parameters containing injection payloads or modified values. The vulnerable getServerSideProps function processes these malicious parameters without proper validation, returning sensitive booking information such as cancelled appointment details, user identifiers, rescheduling reasons, or metadata that should be restricted. The attacker iterates through parameter variations to enumerate multiple bookings, building a database of organizational scheduling patterns, employee names, client information, or meeting purposes for competitive intelligence, social engineering, or privacy violation purposes.