PT-2026-49307 · Discuzx · Discuzx

Egidio Romano · CVE-2026-49952 · Published 2026-06-15 · Updated 2026-06-16

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Discuz! X5.0 versions 20260320 through 20260501

Description An authentication bypass allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality. This is possible due to a shared cryptographic key between UCenter integration and the database backup API exposed by the 'dbbak.php' endpoint. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in the logging more() function within logging ctl, enabling them to obtain a signed token. This token allows the bypass of authorization for database export and import operations, and a race condition can be triggered to impersonate arbitrary users.

Recommendations For versions 20260320 through 20260501, apply the available patch to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-323

Related Identifiers

CVE-2026-49952

Affected Products

Discuzx

References · 9

• 🔥 https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce · Exploit
• https://gitee.com/Discuz/DiscuzX/commit/9962dad52c4c6999dabaf91ecd70377c680ff3c6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-49952 · Security Note
• https://vulncheck.com/advisories/discuz-x5-0-authentication-bypass-via-dbbak-php-encryption-oracle · Note
• http://seclists.org/fulldisclosure/2026/Jun/3 · Note
• https://twitter.com/OrizonCyber/status/2066619297670066417 · Twitter Post
• https://t.me/CVEtracker/56887 · Telegram Post
• https://karmainsecurity.com/KIS-2026-09 · Note
• https://twitter.com/OrizonCyber/status/2066777833142116809 · Twitter Post