Is CVE-2026-9303 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9303 being exploited in the wild.

How severe is CVE-2026-9303?

Medium severity, with a CVSS score of 4.3, published 23 May 2026.

Is there a fix for CVE-2026-9303?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9303 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-9303?

Check whether you run Cal.Com at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9303: Cal.com cal.diy CSRF in Availability API and OAuth Callbacks

CVE-2026-9303 · Severity: medium · CVSS 4.3 · Published 2026-05-23

A security vulnerability exists in Cal.com (cal.diy), an open-source scheduling platform. The flaw allows an attacker to trick a logged-in user into performing unintended actions, such as modifying their calendar availability or linking the attacker's third-party accounts (like Basecamp or Stripe) to the victim's profile. This can lead to unauthorized account access, data pollution, or a denial of service where the victim's scheduling availability is corrupted.

Technologies: Cal.Com. Vendors: Cal.com.

Quick answers

Is CVE-2026-9303 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9303 being exploited in the wild.
How severe is CVE-2026-9303?: Medium severity, with a CVSS score of 4.3, published 23 May 2026.
Which products and versions are affected?: Cal.Com up to 4.9.4.
Is there a fix for CVE-2026-9303?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9303 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-9303?: Check whether you run Cal.Com at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities exist in Cal.com (cal.diy) up to version 4.9.4. The first issue resides in the Calendar Availability API (/api/availability/calendar), where the Next.js App Router fails to validate CSRF tokens and improperly processes 'text/plain' requests as JSON, bypassing CORS preflight checks. The second issue involves the OAuth callback handlers where a hardcoded allowlist (NONCE_EXEMPT_APPS) exempts specific integrations (Stripe, Basecamp3, Dub, Webex, Tandem) from nonce validation. Furthermore, these handlers commit OAuth token linkages to the database before verifying the state parameter. An unauthenticated remote attacker can exploit these flaws by inducing a victim with an active session to visit a malicious URL or execute a cross-origin fetch request, leading to unauthorized calendar mutation or account takeover via rogue integration linking.

Affected products

Cal.com cal.diy up to 4.9.4

Timeline

2026-04-06: disclosed: Vulnerability details and PoC published on GitHub Gist
2026-05-23: advisory: CVE-2026-9303 published via VulDB/NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.