CVE-2026-68923— MobSF: CSRF checks not enforced after Django migration
Possible ATT&CK Techniques 2AI
T1190 · Exploit Public-Facing Application T1556 · Modify Authentication ProcessAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MobSF | Mobile-Security-Framework-MobSF | < 4.5.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-68923
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MobSF: CSRF checks not enforced after Django migration
Source: CVE Program / CVE List V5
Vulnerability Description
MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MobSF | Mobile-Security-Framework-MobSF | < 4.5.1 | - |
II. Public POCs for CVE-2026-68923
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-68923
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-68923 (1)
Vendor Advisories for CVE-2026-68923 (1)
Vendor Pages for CVE-2026-68923 (1)
Same Patch Batch · MobSF · 2026-08-18 · 4 CVEs total
| CVE-2026-68922 | 5.5 MEDIUM | MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads |
| CVE-2026-68924 | 4.9 MEDIUM | MobSF: Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction |
| CVE-2026-68927 | 3.0 LOW | MobSF: SSRF port restriction bypass in assetlinks_check |
IV. Related Vulnerabilities
Same product: Mobile-Security-Framework-MobSF
- CVE-2026-68927
MobSF: SSRF port restriction bypass in assetlinks_check - CVE-2026-68922
MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads - CVE-2026-68924
MobSF: Zip Bomb Denial of Service via Per-File Size Limit By - CVE-2026-33545
MobSF has SQL Injection in its SQLite Database Viewer Utils - CVE-2026-24490
MobSF has Stored XSS via Manifest Analysis - Dialer Code Hos
Same vendor: MobSF
- CVE-2026-68927
MobSF: SSRF port restriction bypass in assetlinks_check - CVE-2026-68922
MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads - CVE-2026-68924
MobSF: Zip Bomb Denial of Service via Per-File Size Limit By - CVE-2026-33545
MobSF has SQL Injection in its SQLite Database Viewer Utils - CVE-2026-24490
MobSF has Stored XSS via Manifest Analysis - Dialer Code Hos
Same weakness: CWE-352
- CVE-2026-77391
SourceCodester Dynamic Input Field Generator Using HTML, CSS - CVE-2026-66001
Frappe: Improper Authorization in OAuth2 Consent Endpoint - CVE-2026-63654
Frappe: Unauthenticated Workflow approval via confirm_action - CVE-2026-64962
Cross-Site Request Forgery (CSRF) in ATutor - CVE-2026-28164
WordPress Easy Elementor Addons plugin <= 2.3.7 - Cross Site
V. Comments for CVE-2026-68923
No comments yet