Discuz! X5.0 CVE-2026-49952

No special conditions beyond reachability - exploitation requires only network access to a Discuz! X5.0 instance running a build dated 20260320 through 20260501 with the default UCenter integration enabled and dbbak.php reachable (the standard out-of-the-box configuration). No credentials, no user interaction, and no prior foothold are needed; the encryption oracle is reached through the unauthenticated login endpoint and the dbbak.php authorization check accepts any token signed with the shared key. Limiting factors are narrow: the dbbak.php endpoint or admin path must not be blocked by an upstream WAF/reverse-proxy ACL, and full user impersonation (as opposed to bare backup access) additionally requires winning a race condition, which is reliable on networked targets but may need multiple attempts on high-latency links.

Real-world risk is high and credible. The CVSS:4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H (score 9.3) is consistent with the description: a network-reachable login form feeds an encryption oracle that yields admin-level database access without credentials or user interaction. Confidence is reinforced by VulnCheck-reported research with a detailed write-up at karmainsecurity.com chaining the bugs to RCE via database import, plus a vendor commit on Gitee, so POC availability is not theoretical. EPSS and CISA KEV status were not supplied in the input, so widespread mass exploitation cannot be asserted yet - but with public exploit chain documentation, a working patch diff to reverse, and an internet-exposed admin endpoint, this should be treated as imminent-exploitation risk rather than a high-CVSS-but-low-real-risk issue. Availability impact is rated N in the vector, but in practice attacker-controlled database import trivially destroys availability of forum data; defenders should not under-weight this based on VA:N alone.

An unauthenticated attacker reaches a public Discuz! X5.0 forum's login page and submits a crafted username parameter that coerces logging_ctl::logging_more() to encrypt attacker-chosen plaintext with the shared UCenter key, returning a legitimately signed token in the response or logs. The attacker replays that token against dbbak.php to export the full member database (password hashes, PII) and then re-imports a malicious dump, while simultaneously winning the documented race condition to impersonate an administrator - the karmainsecurity.com write-up explicitly chains these primitives to remote code execution.