CVE-2026-68923
Received Received - Intake

CSRF Protection Missing in MobSF Prior to 4.5.1

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description
MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-68923
EUVD
EUVD-2026-61134

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mobsf mobsf to 4.5.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in MobSF versions before 4.5.1. The Django CSRF protection middleware was incorrectly placed only in the deprecated MIDDLEWARE_CLASSES setting and omitted from the active MIDDLEWARE tuple. This allows attackers to trick authenticated users into submitting malicious POST requests to endpoints like /delete_scan/, /upload/, or /change_password/ without requiring a CSRF token.

Detection Guidance

Check if MobSF version is 4.5.0 or earlier. Verify if CsrfViewMiddleware is missing from the MIDDLEWARE tuple in mobsf/MobSF/settings.py. Use curl to test authenticated POST endpoints like /delete_scan/ with a session cookie to see if actions succeed without a CSRF token.

Impact Analysis

An attacker could exploit this to perform actions on your behalf, such as deleting scans, uploading or downloading files, changing passwords, or managing user accounts. The attack requires user interaction, like visiting a malicious website, but can be executed with just a session cookie due to SameSite=Lax behavior.

Mitigation Strategies

Upgrade MobSF to version 4.5.1 or later. Ensure CsrfViewMiddleware is added to the MIDDLEWARE tuple in settings.py. Remove any references to MIDDLEWARE_CLASSES to prevent similar issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68923. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart