CVE-2026-68923 - MobSF: CSRF checks not enforced after Django migration
Brief
CVE ID : CVE-2026-68923
Published : Aug. 18, 2026, 6:19 p. m.
- 49 minutes ago
Description : MobSF is a mobile application security testing tool used. Prior to 4.
- 1, mobsf/MobSF/settings. py places django. middleware. csrf.
CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/.
This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.
- 1.
Severity: 6.5
- MEDIUM