CVE-2026-68923: Mobsf Mobile-Security-Framework-Mobsf

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.

Affected products

• Mobsf Mobile-Security-Framework-Mobsf: before 4.5.1 (fixed in 4.5.1)

Published 2026-08-18. Last modified 2026-09-18.