Executive brief
A security vulnerability exists in Cal.com (cal.diy), an open-source scheduling platform. The flaw allows an attacker to trick a logged-in user into performing unintended actions, such as modifying their calendar availability or linking the attacker's third-party accounts (like Basecamp or Stripe) to the victim's profile. This can lead to unauthorized account access, data pollution, or a denial of service where the victim's scheduling availability is corrupted.
Technical details
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities exist in Cal.com (cal.diy) up to version 4.9.4. The first issue resides in the Calendar Availability API (/api/availability/calendar), where the Next.js App Router fails to validate CSRF tokens and improperly processes 'text/plain' requests as JSON, bypassing CORS preflight checks. The second issue involves the OAuth callback handlers where a hardcoded allowlist (NONCE_EXEMPT_APPS) exempts specific integrations (Stripe, Basecamp3, Dub, Webex, Tandem) from nonce validation. Furthermore, these handlers commit OAuth token linkages to the database before verifying the state parameter. An unauthenticated remote attacker can exploit these flaws by inducing a victim with an active session to visit a malicious URL or execute a cross-origin fetch request, leading to unauthorized calendar mutation or account takeover via rogue integration linking.
Affected products
- Cal.com cal.diy up to 4.9.4
Timeline
- 2026-04-06: disclosed: Vulnerability details and PoC published on GitHub Gist
- 2026-05-23: advisory: CVE-2026-9303 published via VulDB/NVD