This vulnerability exists in calcom cal.diy up to version 4.9.4 within the getServerSideProps function of the bookings-single-view component. By manipulating the cancelledBy or rescheduledBy arguments, an attacker can cause information disclosure remotely without requiring privileges or user interaction. The issue was publicly disclosed, but the vendor has not provided a response or patch. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, and low impact on confidentiality with no impact on integrity or availability.

An attacker can remotely exploit this vulnerability to disclose information via crafted inputs to the affected function. The disclosed information could potentially aid further attacks or leak sensitive data. There is no indication of impact on system integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as input validation or restricting access to the affected functionality if possible. Monitor for updates from the vendor regarding patches or official mitigations.