The Note Taking App contains a function that can be misused to perform unauthorized changes without the user’s consent. An attacker can send a crafted request from a malicious website, causing the victim to unknowingly modify or delete information. This flaw aligns with CWE‑352 and CWE‑862, indicating missing CSRF protection and inadequate authorization checks, and threatens the integrity of user data.

SourceCodester’s Note Taking App, version 1.0 and earlier, is affected. The unspecified function that enables note manipulation is part of the application’s core functionality, exposing all users running these releases to potential exploitation.

The CVSS score of 5.3 classifies the issue as medium severity. The exploit is publicly available and can be performed remotely by luring an authenticated user to visit a malicious page, which then sends the forged request to the app. Although the EPSS score is unavailable and the vulnerability is not listed in the KEV catalog, its remote nature and public exploits make it a realistic threat for environments that use the vulnerable version.