CVE-2026-68923 json
MobSF: CSRF checks not enforced after Django migration
published 2026-08-18 2 mo ago modified 2026-10-22 17 d ago also EUVD-2026-61134 , GHSA-3p54-567p-2wpr , PYSEC-2026-3688
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.
Patch / fix
- pypi mobsf 4.5.1
- opensecurity mobile_security_framework 4.5.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 mo ago
Exploit prediction
0.26% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mobsf | <4.5.1 |
4.5.1 |
Affected products
- MobSF Mobile-Security-Framework-MobSF
Classification
- Weakness
-
- CWE-352 Cross-Site Request Forgery
References
-
github.com
/MobSF/Mobile-Security-Framework-MobSF/pull/2627
web
-
github.com
/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf
web
-
github.com
/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-3p54-567p-2wpr
web
-
github.com
/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1
web
-
github.com
/MobSF/Mobile-Security-Framework-MobSF
package
-
pypi.org
/project/mobsf
package
-
github.com
/advisories/GHSA-3p54-567p-2wpr
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-68923
advisory
Sources
- CVE List CVE-2026-68923
- GitHub Advisory GHSA-3p54-567p-2wpr
- NVD CVE-2026-68923
- OSV PYSEC-2026-3688
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.