This vulnerability in calcom cal.diy (versions 4.9.0 through 4.9.4) allows remote attackers to perform cross-site request forgery attacks. The exact function affected is unspecified. Exploitation requires user interaction (UI required) but no privileges or authentication are needed. The vendor has not provided a fix or comment, and no patch links or remediation details are available. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on integrity.

Successful exploitation could allow an attacker to cause an authenticated user to perform unintended actions on the cal.diy application, potentially leading to unauthorized state changes. The impact is limited to the integrity of the affected function, with no confidentiality or availability impact noted. There is no evidence of active exploitation in the wild at this time.

No official patch or remediation is currently available as the vendor has not responded to disclosure. Users should monitor vendor communications for updates. Until a fix is provided, applying general CSRF mitigations such as disabling or restricting access to vulnerable functions, or using web application firewalls with CSRF protections, may help reduce risk.