CVE-2023-42261 Withdrawn Advisory: Mobile Security Framework (MobSF) Vulnerable to Insecure Permissions

What is CVE-2023-42261?

CVE-2023-42261 is a high-severity missing authorization vulnerability in n/a, published on 21 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions. NOTE: the vendor's position is that authentication is intentionally not implemented because the product is not intended for an untrusted network environment. Use cases requiring authentication could, for example, use a reverse proxy server.

Weakness: CWE-276

Which versions are affected by CVE-2023-42261?

3 open source packages ship an affected version, including mobsf. It affects 1 product.

Products include Opensecurity Mobile Security Framework.

How do I fix CVE-2023-42261?

Upgrade mobsf to 3.9.7 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-42261 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-42261 exists.

Other vulnerabilities in n/a

• CVE-2025-46335 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload High 8.6
• CVE-2025-24805 Local Privilege Escalation in MobSF High 8.5
• CVE-2025-24803 Stored Cross-Site Scripting (XSS) in MobSF High 8.4
• CVE-2026-24490 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field High 8.1
• CVE-2024-53999 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cc8j-6phr-jv9x, PYSEC-2023-310.