CSRF protection for MENA portals: a request review

A procurement manager is signed into a portal when another website induces the browser to submit a change to it. The request carries a valid session cookie. The manager never approved the change. That