The Notification for Telegram plugin by rainafarai, versions up to 3.5, contains a CSRF vulnerability that could allow attackers to induce authenticated users to perform unintended actions via crafted requests. The vulnerability does not require privileges or result in confidentiality or availability impact but can cause limited integrity impact. The CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability could allow an attacker to cause limited integrity impact by tricking users into submitting unauthorized requests. There is no impact on confidentiality or availability. No known exploits have been reported, and the overall severity is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing CSRF protections such as verifying request origins or using anti-CSRF tokens if possible. Monitor vendor channels for updates.