The vulnerability CVE-2025-49446 is a CSRF issue in the minhlaobao Admin Notes application affecting versions up to 1.1. It allows an attacker to induce an authenticated user to perform actions without their consent by exploiting the lack of proper CSRF protections. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity, no privileges required, and requires user interaction. The impact is limited to integrity loss without confidentiality or availability impact.

The vulnerability could allow an attacker to cause a user to perform unintended actions within the Admin Notes application, potentially altering data or settings. There is no confidentiality or availability impact reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider implementing CSRF protections such as anti-CSRF tokens or other application-level mitigations if possible.