calcom cal.diy cross-site request forgery
Priority MEDIUM 57CWE-352Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Tampering, Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-352 and CWE-862.
Summary
A vulnerability was identified in calcom cal.diy up to 4.9.4. Impacted is an unknown function. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00194 9th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| calcom | cal.diy | 4.9.0; 4.9.1; 4.9.2; 4.9.3; 4.9.4 | — | No fix listed | CNA |
- cal.diy Vendorcalcom Affected 4.9.0; 4.9.1; 4.9.2; 4.9.3; 4.9.4 Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:calcom:cal.diy:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:calcom:cal.diy:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-9303
- 2026-10-03 Alias added: GHSA-m2vm-mcmh-jrc7
References
More calcom vulnerabilities
- TI-2024-38439 Cal.com through 4.7.15 Cross-Site Scripting via booking questions CVSS 4.0CRITICAL 9.3
- TI-2024-38437 Cal.com through 4.7.15 Cross-Site Scripting via booking questions CVSS 4.0CRITICAL 9.3
- TI-2024-38438 cal.com Repository Takeover via pull_request_target Workflow CVSS 4.0HIGH 8.5
- TI-2026-08199 calcom cal.diy Generic React API bookings-single-view.getServerSideProps.tsx getServerSideProps information disclosure CVSS 4.0MEDIUM 6.9
- TI-2023-19352 Cal.com not expiring old sessions after enabling 2FA CVSS 3.1MEDIUM 6.5
- TI-2026-76231 Authorization bypass in cal.com and cal.diy webhook handler CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-9303 · CVE Program
- CVE-2026-9303 · NVD
- FIRST EPSS
- GHSA-m2vm-mcmh-jrc7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences