Is there a public PoC exploit available for EUVD-2026-36793?

Yes, a public proof-of-concept exploit is available for EUVD-2026-36793. Prioritise patching immediately. EPSS: 0.4%.

Discuz! X5.0 EUVD-2026-36793

Q: What is the CVSS score of EUVD-2026-36793?

EUVD-2026-36793 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-49953 MEDIUM

Guessable CAPTCHA (CWE-804)

2026-06-15 VulnCheck

GHSA-p3qj-vw7q-v9pc

Authentication Bypass Discuz X5 0

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible unauthenticated bypass (AV:N/PR:N/AC:L) with limited confidentiality and integrity impact on protected endpoints; no availability impact and scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 19:58 vuln.today

DescriptionCVE.org

Discuz! X5.0 releases 20260320 through 20260501 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.

AnalysisAI

CAPTCHA challenge controls in Discuz! X5.0 (releases 20260320-20260501) can be reliably defeated by unauthenticated remote attackers who harvest samples from exposed forum endpoints and train a custom optical character recognition model to predict challenge text. The underlying weakness - CWE-804 - stems from a limited, predictable character set and insufficient visual distortion in generated images, enabling automation of login, registration, and other abuse-protected flows. Critically, a publicly available exploit exists and KarmaInsecurity has documented chaining this bypass with a race condition to achieve full remote code execution, substantially elevating practical risk beyond the standalone CVSS 4.0 score of 6.9.

Technical ContextAI

CWE-804 (Use of a Guessable CAPTCHA) identifies the root cause: Discuz! X5.0's built-in challenge generation algorithm produces images with a character set and distortion profile insufficient to resist machine-learning-based recognition. Discuz! X5.0 is a PHP-based community forum platform; the affected product is confirmed via CPE cpe:2.3:a:discuz!:discuz!_x5.0. The vulnerability resides in the CAPTCHA image rendering subsystem, which controls access to login, registration, and high-value form endpoints. Because the character set is limited and the visual noise is predictable, an attacker can collect a statistically significant corpus of CAPTCHA images through unauthenticated HTTP requests, label them, and train a convolutional OCR model that generalizes well to unseen challenges - effectively nullifying the bot-prevention control without any cryptographic or authentication weakness.

RemediationAI

No exact patched release version is confirmed in the available input data; operators must verify directly with the Discuz! project and monitor the advisories at https://karmainsecurity.com/KIS-2026-10 and https://www.vulncheck.com/advisories/discuz-x5-0-captcha-bypass-via-predictable-character-set for patch availability. As an immediate compensating control, replace the native CAPTCHA with a third-party service such as hCaptcha or Google reCAPTCHA v3, accepting the trade-off of external service dependency and user privacy considerations. Rate-limit login and registration endpoints at the reverse proxy or WAF layer - for example, enforcing a maximum of 10 requests per IP per 60-second window - to raise the practical cost of OCR-based automation without fully resolving the root cause. Anomaly detection on registration and login velocity patterns should be enabled to surface exploitation attempts. Given the documented RCE chain (https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce), remediating this CAPTCHA bypass should be treated as a prerequisite to blocking that full attack path.