CVE-2026-49952
published 2026-06-15CVE-2026-49952: Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain…
PriorityP277critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EXPLOIT
EPSS
4.72%
91.2th percentile
Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in logging_ctl::logging_more(), obtain a legitimately signed token, and use it to bypass authorization for database export and import operations, with the additional ability to trigger a race condition to impersonate arbitrary users.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| discuz! | discuz!_x5.0 | 20260320 – 20260501 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor POST requests to /member.php?mod=logging&action=login&lssubmit=yes where the 'username' parameter contains pipe-delimited values (e.g., 'admin|1|0|0') indicative of the encryption oracle abuse payload. ↗
- →Alert on GET requests to /api/db/dbbak.php with query parameters 'code=', 'operation=backup', and 'appid=1', especially from unauthenticated or previously unauthenticated sessions. ↗
- →Detect token reuse: flag cases where an authcode extracted from a login response is immediately reused in a dbbak.php request within the same session or short time window. ↗
- →Look for HTTP 200 responses to /api/db/dbbak.php from unauthenticated clients — successful exploitation returns HTTP 200 with database backup content. ↗
- →Inspect login responses for embedded authcode tokens (alphanumeric strings 32–60 characters) in the response body, which should not normally appear in failed or unauthenticated login responses. ↗
- →Flag race condition exploitation attempts: rapid repeated requests to /api/db/dbbak.php with the same authcode token targeting different user contexts (user impersonation via race condition). ↗
- ·The vulnerability exploits a SHARED cryptographic key (UC_KEY) between UCenter integration and the database backup API. Rotating or isolating the UC_KEY between components would break the encryption oracle chain. ↗
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Discuz X5.0 Database Backup API dbbak.php logging_more Username nonce re-use (ID 20260501 / EDB-52621)
vuldb·2026-07-14·CVSS 9.1
CVE-2026-49952 [CRITICAL] Discuz X5.0 Database Backup API dbbak.php logging_more Username nonce re-use (ID 20260501 / EDB-52621)
A vulnerability, which was classified as critical, has been found in Discuz X5.0. The affected element is the function logging_ctl::logging_more of the file dbbak.php of the component Database Backup API. This manipulation of the argument Username causes reusing a nonce.
This vulnerability appears as CVE-2026-49952. The attack may be initiated remotely. In addition, an exploit is available.
It is suggested to install a patch to address this issue.
GHSA
GHSA-mx47-h32c-x878: Discuz! X5
ghsa_unreviewed·2026-06-15
CVE-2026-49952 [CRITICAL] CWE-323 GHSA-mx47-h32c-x878: Discuz! X5
Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in logging_ctl::logging_more(), obtain a legitimately signed token, and use it to bypass authorization for database export and import operations, with the additional ability to trigger a race condition to impersonate arbitrary users.
No detection rules found.
Exploit-DB
Discuz! X5.0 - Authentication Bypass
exploitdb·2026-07-07·CVSS 9.1
CVE-2026-49952 [CRITICAL] Discuz! X5.0 - Authentication Bypass
Discuz! X5.0 - Authentication Bypass
---
# Exploit Title: Discuz! X5.0 - Authentication Bypass
# CVE: CVE-2026-49952
# Date: 2026-06-26
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub: https://github.com/mbanyamer
# Author Blog : https://banyamersecurity.com/blog/
# Vendor Homepage: https://www.discuz.vip
# Software Link: https://www.discuz.vip
# Affected: Discuz! X5.0 (20260320 - 20260501)
# Tested on: Discuz! X5.0
# Category: WebApps
# Platform: PHP
# Exploit Type: Authentication Bypass
# CVSS: 9.1
# Description: Discuz! X5.0 suffers from an authentication bypass vulnerability via dbbak.php using UC_KEY encryption oracle allowing token reuse.
# Fixed in: 20260510+
# Usage:
# python3 exploit.py
#
# Examples:
# python3 e
Nuclei
Discuz! X5.0 - Authentication Bypass
nuclei·CVSS 9.1
CVE-2026-49952 [CRITICAL] Discuz! X5.0 - Authentication Bypass
Discuz! X5.0 - Authentication Bypass
Discuz! X5.0 20260320 through 20260501 contains an authentication bypass caused by exploitation of a shared cryptographic key and encryption oracle in dbbak.php and logging_ctl::logging_more(), letting unauthenticated remote attackers access database backup and restore functions, exploit requires crafted payload injection via username parameter.
Template:
id: CVE-2026-49952
info:
name: Discuz! X5.0 - Authentication Bypass
author: 0x_Akoko
severity: critical
description: |
Discuz! X5.0 20260320 through 20260501 contains an authentication bypass caused by exploitation of a shared cryptographic key and encryption oracle in dbbak.php and logging_ctl::logging_more(), letting unauthenticated remote attackers access database backup and restore functions, e
No writeups or analysis indexed.
https://gitee.com/Discuz/DiscuzX/commit/9962dad52c4c6999dabaf91ecd70377c680ff3c6https://karmainsecurity.com/KIS-2026-09https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rcehttps://www.vulncheck.com/advisories/discuz-x5-0-authentication-bypass-via-dbbak-php-encryption-oraclehttp://seclists.org/fulldisclosure/2026/Jun/3
2026-06-15
Published