CVE-2026-9303
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A CSRF vulnerability has been identified in calcom cal.diy up to version 4.9.4. An unknown function allows CSRF attacks that can be initiated remotely. The exploit is publicly available. The vendor did not respond.
Risk Assessment
Risk of unauthorized actions performed on behalf of an authenticated user, such as changing settings or calendar data.
Recommendation
Implement CSRF protections (e.g., tokens) and consider replacing the component if the vendor is unresponsive.
Other vulnerabilities in calcom cal.diy
See all- CVE-2026-104054Medium
A security flaw has been discovered in calcom cal.diy up to 6.2.0. It affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Manipulation results in missing authorization. The attack can be initiated remotely. The exploit has been released to the public and may be used. The pull request to fix this issue awaits acceptance.
- CVE-2026-9349Medium
Vulnerability in calcom cal.diy up to version 4.9.4. The getServerSideProps function in apps/web/modules/bookings/views/bookings-single-view.getServerSideProps.tsx of the Generic React API component causes information disclosure via manipulation of cancelledBy/rescheduledBy arguments. The attack can be initiated remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was identified in calcom cal.diy up to 4.9.4. Impacted is an unknown function. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS