CVE-2026-68923

Name of the Vulnerable Software and Affected Versions MobSF versions prior to 4.5.1

Description In the settings.py file, the django.middleware.csrf.CsrfViewMiddleware is placed only in the deprecated MIDDLEWARE CLASSES setting and omitted from the active MIDDLEWARE tuple. This configuration error allows a remote attacker to perform Cross-Site Request Forgery (CSRF), which is a technique that tricks a logged-in user into executing unwanted actions on a web application. Consequently, an attacker can force a logged-in victim to submit cross-site POST requests to authenticated endpoints, including '/delete scan/', '/upload/', '/download scan/', '/change password/', '/create user/', and '/delete user/'. This could lead to the unauthorized deletion of scans, uploading or downloading of applications, password changes, or user management based on the victim's account permissions.

Recommendations Update to version 4.5.1.