SourceCodester Note Taking App versions up to 1.0 contain a vulnerability that allows an attacker to forge requests on behalf of a legitimate user. The weakness creates a remote cross‑site request forgery (CSRF) condition in an unknown function, enabling the attacker to execute unauthorized actions without the victim's knowledge. This can lead to unauthorized data alteration, deletion, or other privileged operations performed by the authenticated user, thereby compromising the application's confidentiality, integrity, and availability.

The affected product is SourceCodester Note Taking App, with all releases up to version 1.0. No finer version granularity is provided beyond the stated maximum. The vendor is SourceCodester.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not provided. The vulnerability is not listed in the CISA KEV catalog. The exploit is publicly available and can be performed remotely by any user with network access to the application. Attackers may craft a malicious web page or email that induces a victim to visit a URL or submit a form that triggers the vulnerable function, thereby bypassing authentication safeguards when a valid session cookie is automatically sent by the browser.