CSRF is part of security misconfiguration in the OWASP Top 10.
The note is not visible to the blocked user.