Medium severity · published May 23, 2026
CVE-2026-9303
calcom cal.diy cross-site request forgery
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was identified in calcom cal.diy up to 4.9.4. Impacted is an unknown function. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
cal.diy · calcom
4.9.0; 4.9.1; 4.9.2; 4.9.3; 4.9.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9303
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9303
gist.github.com
https://gist.github.com/YLChen-007/26663d9558e15994176dc420d2e11d48
gist.github.com
https://gist.github.com/YLChen-007/dafada36e356bc895b09829d8ec57e49
vuldb.com
https://vuldb.com/submit/812173
vuldb.com
https://vuldb.com/submit/812175
vuldb.com
https://vuldb.com/vuln/365250
vuldb.com
https://vuldb.com/vuln/365250/cti
More from cal.diy
10.0
CVE-2025-71389
Cal.com before 5.9.9 Remote Code Execution via RSC
9.9
CVE-2024-58354
cal.com Repository Takeover via pull_request_target Workflow
8.9
CVE-2024-58355
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
8.9
CVE-2024-58353
Cal.com through 4.7.15 Cross-Site Scripting via booking questions
6.3
CVE-2026-112043
calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization