The vulnerability lies in MobSF’s migration of Django middleware configuration, which omitted the CsrfViewMiddleware from the active MIDDLEWARE tuple. This oversight allows a remote attacker, by crafting a malicious CSRF payload, to persuade a logged‑in victim to submit authenticated POST requests to endpoints such as /delete_scan/, /upload/, /download_scan/, /change_password/, /create_user/, and /delete_user/. The attacker can therefore delete scans, upload or download applications, change passwords, or perform user administration actions under the victim’s credentials. This loss of control over authenticated sessions constitutes a moderate‑severity breach of integrity and confidentiality for the affected user’s data.

The issue affects MobSF Mobile‑Security‑Framework‑MobSF versions prior to 4.5.1. The specific products impacted are all releases of this tool from the earliest until just before the 4.5.1 update that fixes the configuration mistake. Users running any version older than 4.5.1 should consider themselves vulnerable.

The CVSS score of 6.5 indicates a moderate risk, and the expertise needed to exploit the flaw is in the medium range: a threat actor must reach the victim’s browser to deliver a CSRF vector. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, public exploitation activity has not been documented, but the attack surface remains present. The most reliable mitigation is to upgrade to 4.5.1 or later, where CsrfViewMiddleware is correctly enabled, or otherwise restore it in the active middleware configuration.