This vulnerability in calcom cal.diy (up to version 4.9.4) involves the getServerSideProps function of the bookings-single-view React component. By manipulating the cancelledBy or rescheduledBy parameters, an attacker can cause information disclosure remotely without requiring privileges or user interaction. The vendor has not issued any patch or official remediation, and the vulnerability is publicly known.

Successful exploitation results in unauthorized information disclosure due to improper handling of specific input parameters in the affected function. This could potentially expose sensitive data to remote attackers. There are no reports of active exploitation in the wild, and the impact is limited to information disclosure without further privilege escalation or code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing input validation or filtering on the affected parameters as a temporary mitigation. Monitor for any updates from the vendor regarding official patches or workarounds.