Discuz! X5.0 EUVD-2026-36793

No special conditions are required for the CAPTCHA bypass itself - any internet-facing Discuz! X5.0 instance running a release between 20260320 and 20260501 with its default built-in CAPTCHA enabled is exploitable from the network without authentication, credentials, or elevated privileges (consistent with AV:N/PR:N in the CVSS 4.0 vector). The practical prerequisite limiting casual exploitation is the offline model-training phase: an attacker must harvest a sufficient corpus of CAPTCHA samples and train a custom OCR model before automation becomes reliable, adding meaningful but one-time upfront effort. Exploitation is bounded to the affected release date window; deployments outside 20260320-20260501 are not confirmed vulnerable. Escalation to RCE via the documented chain additionally requires whatever conditions the race condition vulnerability imposes, which are governed by a separate, related CVE not assessed here.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N) scores 6.9 Medium, reflecting network-accessible, zero-prerequisite exploitation with low individual-impact ceiling. In isolation this would suggest moderate priority, but several additional signals elevate real-world urgency: a publicly available exploit is confirmed by VulnCheck reporting, and the KarmaInsecurity reference at https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce explicitly demonstrates using this CAPTCHA bypass as a precondition for a race-condition-to-RCE exploit chain - an impact far beyond the base CVE score. No CISA KEV listing is present, and EPSS data was not supplied, so widespread in-the-wild exploitation is not confirmed, but the combination of public POC, documented RCE chain, and zero-authentication barrier makes this a high-priority remediation for any internet-facing Discuz! X5.0 deployment.

An attacker sends thousands of unauthenticated GET requests to the Discuz! X5.0 forum's CAPTCHA endpoint, collecting labeled image samples which are used to train a lightweight CNN-based OCR model achieving high solve accuracy against unseen challenges. With the CAPTCHA bypass operational, the attacker automates credential-stuffing or bulk account registration. Per published KarmaInsecurity research, the attacker then leverages the registered account access to trigger a race condition in a separate code path, ultimately escalating to remote code execution on the host server.