CVE-2026-68923: Mobile-Security-Framework-MobSF < 4.5.1

Affected technology

Mobile-Security-Framework-MobSF · < 4.5.1
MobSF

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

The source says prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. Vendor/CNA’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality and availability impact as none; integrity impact as high.