CVE-2026-4971

A Cross-Site Request Forgery (CSRF) vulnerability exists in the note deletion functionality of SourceCodester Note Taking App version 1.0. The application performs a state-changing DELETE operation through a GET request to notes/delete.php without any CSRF token validation, as detailed in a public advisory [1].

An attacker can exploit this by crafting a malicious webpage that silently issues a GET request to the vulnerable endpoint with a targeted note ID. When an authenticated victim visits the page while logged in, the request executes, deleting the specified note. The proof-of-concept uses an invisible image tag to trigger the request [1].

Successful exploitation allows an attacker to delete arbitrary notes belonging to the victim, leading to potential data loss. The attack does not require authentication bypass but relies on tricking the user into performing an unintended action [1].

As of the publication of the advisory, no fix has been released by SourceCodester. Users are advised to implement CSRF protections, such as synchronizer tokens, to mitigate the risk [1].