Which versions of Discuz! X5.0 are affected by CVE-2026-49952?

Discuz! X5.0 (versions 20260320-20260501) contains a critical authentication bypass that allows unauthenticated attackers to access and control database backup/restore functionality.. A patch is available.

Is there a public PoC exploit available for CVE-2026-49952?

Yes, a public proof-of-concept exploit is available for CVE-2026-49952. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-49952?

Within 24 hours: identify all Discuz! X5.0 instances deployed in versions 20260320-20260501. Within 7 days: apply the vendor patch released on Gitee for Discuz! X5.0; if patching is delayed, restrict external network access to dbbak.php via firewall rules. Within 30 days: audit database backup logs for unauthorized access attempts during the vulnerable window and verify backup integrity.

Discuz! X5.0 CVE-2026-49952

Q: What is the CVSS score of CVE-2026-49952?

CVE-2026-49952 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-36792 CRITICAL

Reusing a Nonce, Key Pair in Encryption (CWE-323)

2026-06-15 VulnCheck

GHSA-mx47-h32c-x878

PHP Authentication Bypass Oracle Discuz X5 0

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-reachable login oracle needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); full DB read/write yields C:H/I:H, and the vendor-assigned 4.0 vector sets VA:N so A:N is retained.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 19:54 vuln.today

DescriptionCVE.org

Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in logging_ctl::logging_more(), obtain a legitimately signed token, and use it to bypass authorization for database export and import operations, with the additional ability to trigger a race condition to impersonate arbitrary users.

Articles & Coverage 1

News Critical Authentication Bypass in Discuz! X5.0 PHP Forum Software - CVE-2026-49952 Jun 15, 2026

AnalysisAI

Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to access database backup and restore functionality exposed by dbbak.php. The flaw stems from a shared cryptographic key (CWE-323) between UCenter integration and the backup API, which lets an attacker abuse an encryption oracle in logging_ctl::logging_more() to mint legitimately signed authorization tokens, and chain a race condition to impersonate arbitrary users. Publicly available exploit code exists and an upstream fix has been published on Gitee.

Technical ContextAI

Discuz! X5.0 is a widely deployed PHP-based community forum/CMS originally developed by Comsenz/Tencent and now maintained on Gitee. UCenter is Discuz!'s shared user-center subsystem that uses a symmetric secret for cross-application authentication; dbbak.php is the administrative endpoint exposing database export and import. The root cause is CWE-323 (Reusing a Nonce / Key Pair in Encryption): the same cryptographic key is reused across two functionally distinct contexts - UCenter integration and the dbbak backup API. The login flow's logging_ctl::logging_more() encrypts attacker-controlled input from the username parameter using that shared key, turning it into a generic encryption/signing oracle. Because dbbak.php trusts any token signed with the same key, oracle-produced ciphertext is accepted as a valid authorization token, and a TOCTOU-style race during the user lookup lets the attacker pin the resulting session to any chosen identity.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the vendor commit 9962dad52c4c6999dabaf91ecd70377c680ff3c6 from https://gitee.com/Discuz/DiscuzX or upgrade to any tagged X5.0 release built after 20260501 once published. Until the patched build is rolled out, restrict network access to dbbak.php at the web server or WAF layer (for example, block /utility/dbbak.php and any UCenter API paths from the public internet and allow them only from administrator source IPs); this disables remote backup/restore from the UI and any automation that hits those endpoints, so schedule backups via the CLI or a maintenance VLAN instead. Rotate the UCenter authentication key (UC_KEY) and force re-login of all sessions after patching, because any token minted via the oracle before the fix remains cryptographically valid; rotation will break existing UCenter-integrated apps until they are reconfigured. Review database backup directories for unexpected exports and restored content as an indicator of prior abuse, and consult the research write-up at https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce and advisory https://karmainsecurity.com/KIS-2026-09 for detection guidance.