@@ -2057,7 +2057,15 @@ func (h *Handler) approveRIExchange(ctx context.Context, req *events.LambdaFunct
 			}
 			// Record-level RBAC denied (e.g. approve-own user is not the creator).
 			// If a token is present, preserve legacy token flow; otherwise surface the error.
-			if token == "" || !isPermissionDenied(sessErr) {
+			//
+			// A CSRF rejection must NOT fall through, even with a token present.
+			// isPermissionDenied is a bare 403 test, so without this it cannot tell a
+			// forged cross-site request from a legitimate approve-own denial, and the
+			// request would proceed on the token alone: the exchange executes, but as
+			// an unattributed system approval (transitioned_by NULL, no approved_by
+			// stamp) on a money path. Checked first so the sentinel is never reached
+			// by the 403 test below.
+			if errors.Is(sessErr, errCSRFRejected) || token == "" || !isPermissionDenied(sessErr) {
 				return nil, sessErr
 			}
 		case isPermissionDenied(err):
@@ -2110,7 +2118,7 @@ func (h *Handler) approveRIExchangeViaSession(ctx context.Context, req *events.L
 	// #1757 -- this call was previously reachable with no CSRF token at
 	// all, despite a comment claiming parity with the purchases path).
 	if err := h.validateCSRF(ctx, req); err != nil {
-		return nil, NewClientError(403, "CSRF validation failed")
+		return nil, errCSRFRejected
 	}
 
 	var err error
 
@@ -18,6 +18,14 @@ func (h *Handler) routeRequest(ctx context.Context, method, path string, req *ev
 // errNotFound is a sentinel error for 404 responses.
 var errNotFound = &notFoundError{}
 
+// errCSRFRejected marks a CSRF validation failure so it stays distinguishable
+// from an authorization denial. Both surface as 403, and isPermissionDenied
+// tests the code alone, so a dispatch that falls back to a token flow on 403
+// cannot otherwise tell a forged cross-site request from a legitimate
+// approve-own denial. Compare with errors.Is before any 403 test that decides
+// whether to continue rather than return (issue #1757).
+var errCSRFRejected = NewClientError(403, "CSRF validation failed")
+
 type notFoundError struct{}
 
 func (e *notFoundError) Error() string {
 
@@ -500,6 +500,74 @@ func TestApproveRIExchangeViaSession_RequiresCSRF(t *testing.T) {
 	assert.Contains(t, ce.Error(), "CSRF validation failed")
 }
 
+// TestApproveRIExchange_CSRFFailureDoesNotFallThroughToToken covers the case
+// the empty-token test above cannot reach: a session-authed approve that fails
+// CSRF while carrying a VALID ?token=.
+//
+// approveRIExchange's dispatch falls back to the token flow on a 403 from the
+// session path, so email-link holders can still approve. isPermissionDenied
+// tests the status code alone, so without a distinguishable CSRF error a forged
+// cross-site request is indistinguishable from a legitimate approve-own denial
+// and proceeds on the token: the exchange executes, but as an unattributed
+// system approval (transitioned_by NULL, no approved_by stamp) on a money path.
+//
+// Verified by mutation: replacing errCSRFRejected with a plain
+// NewClientError(403, ...) makes the TransitionRIExchangeStatus assertion below
+// fail, because control reaches approveRIExchangeViaToken.
+func TestApproveRIExchange_CSRFFailureDoesNotFallThroughToToken(t *testing.T) {
+	ctx := context.Background()
+	id := "550e8400-e29b-41d4-a716-446655440021"
+	creatorID := "creator-uuid"
+
+	mockStore := new(MockConfigStore)
+	mockAuth := new(MockAuthService)
+	adminSession := &Session{UserID: "admin-uuid", Email: "admin@example.com"}
+	mockAuth.On("ValidateSession", ctx, "sess-tok").Return(adminSession, nil)
+	mockAuth.grantAdminPurchaser()
+	mockAuth.On("ValidateCSRFToken", ctx, "sess-tok", "").Return(errors.New("csrf mismatch"))
+	t.Cleanup(func() { mockAuth.AssertExpectations(t) })
+
+	// Same full happy-path fixture as the empty-token test, and for the same
+	// reason: registered .Maybe() so a broken guard runs on to the state
+	// transition and fails the assertion, rather than panicking earlier and
+	// proving only that some intermediate call was not reached. ApprovalToken
+	// matches the token passed below, so the token path would genuinely succeed
+	// if the CSRF failure were swallowed.
+	mockStore.On("GetRIExchangeRecord", ctx, id).Return(&config.RIExchangeRecord{
+		ID:              id,
+		Status:          "pending",
+		ApprovalToken:   "tok",
+		SourceRIIDs:     []string{"ri-123"},
+		PaymentDue:      "100.00",
+		CreatedByUserID: &creatorID,
+	}, nil).Maybe()
+	mockStore.On("TransitionRIExchangeStatus", ctx, id, "pending", "processing", mock.Anything).
+		Return(&config.RIExchangeRecord{ID: id, Status: "processing", SourceRIIDs: []string{"ri-123"}, PaymentDue: "100.00"}, nil).Maybe()
+	mockStore.On("GetRIExchangeDailySpend", mock.Anything, mock.Anything).Return("0", nil).Maybe()
+	mockStore.On("GetGlobalConfig", ctx).Return(&config.GlobalConfig{
+		RIExchangeMaxDailyUSD:       1000,
+		RIExchangeMaxPerExchangeUSD: 500,
+	}, nil).Maybe()
+	mockStore.On("FailRIExchange", ctx, id, mock.AnythingOfType("string")).Return(nil).Maybe()
+	mockStore.On("StampRIExchangeApprovedBy", ctx, id, adminSession.Email).Return(nil).Maybe()
+
+	h := &Handler{config: mockStore, auth: mockAuth}
+	req := &events.LambdaFunctionURLRequest{
+		Headers: map[string]string{"authorization": "Bearer sess-tok"},
+	}
+	// Valid token, so the fallback path would succeed if CSRF were swallowed.
+	_, err := h.approveRIExchange(ctx, req, id, "tok")
+
+	// Primary assertion: the money-moving call is never reached.
+	mockStore.AssertNotCalled(t, "TransitionRIExchangeStatus", mock.Anything, mock.Anything, mock.Anything, mock.Anything, mock.Anything)
+
+	require.Error(t, err)
+	ce, ok := IsClientError(err)
+	require.True(t, ok, "expected a ClientError, got: %v", err)
+	assert.Equal(t, 403, ce.code)
+	assert.Contains(t, ce.Error(), "CSRF validation failed")
+}
+
 // TestApproveRIExchangeViaSession_PassesCSRF confirms the CSRF guard does
 // not block the legitimate dashboard flow: a valid CSRF token still reaches
 // TransitionRIExchangeStatus. Without this, "add the CSRF check" could ship