CVE-2026-9303: calcom cal.diy cross-site request forgery

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Configuration

   Implement or enable anti-CSRF protections in the application: require and validate per-request anti-CSRF tokens, verify Origin and/or Referer headers for state-changing requests, and set cookies with SameSite attributes where appropriate.

   calcom cal.diy anti-CSRF protections = enable/implement anti-CSRF tokens; validate Origin/Referer; use SameSite cookies
2. Compensating control

   Until a vendor fix is available, restrict external access to the calcom cal.diy instance (limit to trusted IPs or internal networks) and deploy WAF rules or intrusion-prevention signatures to block known or likely exploit requests, since the vulnerability can be triggered remotely and public exploit code exists.

3. Operational

   Monitor application and web server logs for signs of CSRF exploitation, investigate any suspicious or unexpected state-changing requests, and follow incident response procedures if exploitation is detected (including isolating affected hosts).

Event History

Frequently Asked Questions