This vulnerability in calcom cal.diy (versions 4.9.0 through 4.9.4) enables cross-site request forgery attacks by leveraging an unknown function within the application. An attacker can remotely induce an authenticated user to perform unintended actions without their consent. The vulnerability requires user interaction (UI:P) and does not require privileges or user credentials (PR:N). The vendor has not issued any advisory or patch, and no official remediation is currently available.

Successful exploitation can lead to unauthorized actions performed on behalf of an authenticated user, potentially compromising user data or application integrity. However, the impact is limited by the need for user interaction and the absence of privilege requirements. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should implement standard CSRF mitigations such as verifying origin headers, using anti-CSRF tokens, and limiting the impact of authenticated sessions until a vendor patch is released.