CVE-2026-68923: MobSF: CSRF checks not enforced after Django migration
MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARECLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /deletescan/, /upload/, /downloadscan/, /changepassword/, /createuser/, and /deleteuser/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mobsf/MobSFto a version that resolves this vulnerability.Fixed in 4.5.1 - Compensating control
If you cannot upgrade immediately, mitigate CSRF risk by preventing cross-site POST requests to authenticated MobSF endpoints (/delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, /delete_user/)—e.g., enforce CSRF protection at the application or block cross-origin requests to these endpoints using network/WAF controls.
Event History
Frequently Asked Questions
Which MobSF versions are affected?
MobSF deployments prior to 4.5.1 are affected because the active Django MIDDLEWARE configuration omits CsrfViewMiddleware. Version 4.5.1 fixes the issue.
What does an attacker need to exploit this issue?
An attacker needs to induce a logged-in MobSF user to submit a cross-site POST request; no attacker authentication is required. The impact is limited by the permissions of the victim account.
What can happen if exploitation succeeds?
A successful request can delete scans, upload or download applications, change passwords, and create or delete users through authenticated endpoints. The specific actions available depend on the logged-in victim's permissions.