Skip to content
Fencer Vulns
critical 9.1

CVE-2026-49952 json

Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle

published 2026-06-15 4 mo ago modified 2026-10-25 14 d ago also EUVD-2026-36792

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.7%
EPSS 4.7% chance of exploitation in 30 days, percentile 91%
public exploits
1
Exploit-DB, plus a Nuclei check

Summary

Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in logging_ctl::logging_more(), obtain a legitimately signed token, and use it to bypass authorization for database export and import operations, with the additional ability to trigger a race condition to impersonate arbitrary users.

Patch / fix

Timeline

  1. Published
  2. First public exploit (EDB-52621)

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
4 mo ago

Exploit prediction

4.72% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-52621 Discuz! X5.0 - Authentication Bypass webapps, 2026-07-07
  • Nuclei template Discuz! X5.0 - Authentication Bypass nuclei detection template
  • karmainsecurity.com https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA 4.0 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • Discuz! Discuz! X5.0

Classification

Weakness
  • CWE-323 Reusing a Nonce, Key Pair in Encryption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.