This vulnerability is a CWE-352 Cross-Site Request Forgery issue in the MF Gig Calendar software by Matthew Fries, affecting versions through 1.2.1. It allows attackers to trick authenticated users into submitting unauthorized requests, potentially causing limited integrity and availability impacts. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and results in low integrity and low availability impacts. No patch or official fix has been disclosed as of the published date.

Successful exploitation could lead to unauthorized actions performed by authenticated users without their consent, impacting the integrity and availability of the affected application. Confidentiality is not impacted. The overall severity is medium based on the CVSS score of 5.4. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as anti-CSRF tokens or other application-layer mitigations if possible. Monitor vendor communications for updates on patches or official fixes.