Vulnerability Description
MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1
- https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHS
FAQ
What is CVE-2026-68923?
CVE-2026-68923 is a vulnerability with a CVSS score of 6.5 (MEDIUM). MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and...
How severe is CVE-2026-68923?
CVE-2026-68923 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-68923?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.