The weakness in calcom cal.diy up to version 4.9.4 allows an attacker to manipulate an unknown function, resulting in a cross‑site request forgery (CSRF) vulnerability. This flaw is a classic CSRF issue (CWE‑352) and also carries an element of unauthorized access (CWE‑862) because the attacker can perform actions as a legitimate user. An attacker can send a crafted request from a remote source and trick a logged‑in user into unknowingly executing privileged operations.

All installations of calcom cal.diy with versions 4.9.4 or earlier are impacted. No sub‑version or build information is supplied, so the entire 4.9.4 release series is assumed vulnerable.

The CVSS score is 5.3, indicating a moderate level of severity. EPSS is not provided, but the vulnerability is publicly available and the vendor did not release a fix or response at the time of disclosure. The flaw can be exploited remotely through a crafted request, and no authentication or privileged installation is required. Because it is a CSRF issue, an attacker can redirect a legitimate user’s browser to submit malicious requests. The lack of an official fix means that the risk remains until a patch is released or mitigated by defensive controls.