In CVSS v3, the "scope" indicates whether a vulnerability in an application impacts resources beyond its means. It can have the values "changed" or "unchanged".
And the example CSRF vulnerability has scope unchanged, even though just like the XSS it triggers behavior in the browser.
What does it mean when the scope is changed or unchanged?
It seems from the documentation that the scope is changed when the vulnerability traverses authorization authorities. What is an "authorization authority"?