Cal.com cal.diy CVE-2026-9349

Upgrade to Cal.com cal.diy version 4.9.5 or later if such a patched release becomes available through the project's GitHub repository at https://github.com/calcom/cal.com. Since the vendor has not issued an official advisory or confirmed patch version, organizations must monitor the project repository for commits addressing CVE-2026-9349 or parameter validation in getServerSideProps functions. Immediate compensating controls include implementing Web Application Firewall (WAF) rules to block or sanitize cancelledBy and rescheduledBy parameters in requests to /bookings/* endpoints, though this may break legitimate booking cancellation/rescheduling workflows requiring testing in staging environments first. Apply strict input validation middleware to reject requests with unexpected parameter values or patterns. Consider temporarily restricting access to the bookings API endpoints to authenticated users only via reverse proxy authentication layers, accepting the trade-off of degraded user experience for unauthenticated booking views. Network segmentation to limit cal.diy instance exposure only to trusted networks reduces attack surface but conflicts with typical public-facing calendar use cases. Review application logs for suspicious patterns in cancelledBy/rescheduledBy parameter usage since the exploit became public. Reference the POC at https://gist.github.com/YLChen-007/b59c44d1550c4b0f373ca4eb1c150994 to understand exact exploitation techniques for detection rule development.