Cal.com cal.diy CVE-2026-9304

Exploitation requires authenticated access to the Cal.com cal.diy platform with low-level user privileges (CVSS PR:L), meaning attackers must possess valid login credentials-not exploitable by anonymous users. The high attack complexity (AC:H) indicates successful exploitation requires sophisticated bypass techniques to evade the validateUrlForSSRF function's validation logic, demanding technical understanding of SSRF filter evasion methods such as URL encoding variations, protocol handlers, DNS rebinding, or redirect chains. The vulnerability specifically exists in the Logo API route at /api/logo endpoint, meaning exploitation is limited to authenticated users who can make requests to this specific API path. Network connectivity from the cal.diy server to target systems (internal networks, cloud metadata endpoints, or external attacker-controlled hosts) is required for successful SSRF exploitation. No user interaction is needed (UI:N) once the attacker has authenticated access. Exploitation likelihood is constrained by the need for both valid credentials and technical sophistication to craft validation-bypassing payloads, limiting realistic threat actors to those with insider access or compromised accounts plus advanced SSRF exploitation skills.

Real-world risk is moderate despite the 5.0 CVSS score. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) indicates network-based exploitation requiring authenticated access (PR:L) with high attack complexity (AC:H), limiting the attack surface to authenticated users who can craft sophisticated bypass payloads. Impact is constrained to low confidentiality, integrity, and availability within unchanged scope. The E:P temporal metric confirms a public proof-of-concept exists, lowering the skill barrier for exploitation. However, RL:X indicates no vendor fix is available, and the vendor's non-responsiveness (per description) means no official patch timeline exists. The difficult exploitability assessment and high complexity suggest this is not trivially weaponizable, reducing automated mass exploitation risk. Key missing data: EPSS score unavailable, KEV status not provided (assumed not listed given lack of widespread active exploitation indicators), SSVC decision factors incomplete without EPSS. Priority depends heavily on deployment context-organizations exposing cal.diy to untrusted authenticated users face higher risk than those with strict access controls. The SSRF could enable cloud metadata service access (AWS/Azure/GCP credential theft), internal network reconnaissance, or bypassing firewall restrictions, making this a realistic threat for multi-tenant or cloud-hosted deployments.

An authenticated attacker with low-privilege credentials to a cal.diy instance crafts a malicious URL parameter to the Logo API endpoint, exploiting weaknesses in the validateUrlForSSRF function to bypass validation checks. The attacker targets the cloud metadata service endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/) causing the cal.diy server to fetch and return temporary AWS credentials, which the attacker then uses to access the organization's cloud infrastructure. Alternatively, the attacker uses the SSRF to probe internal network services (databases, admin panels, internal APIs) not directly accessible from the internet, mapping the internal network topology and identifying additional attack vectors.