PT-2026-49308 · Discuzx · Discuzx

Egidio Romano · CVE-2026-49953 · Published 2026-06-15 · Updated 2026-06-15

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Discuz! X5.0 versions 20260320 through 20260610

Description A CAPTCHA bypass allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition (OCR) model—a technology that converts images of text into machine-encoded text—against collected samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.

Recommendations Update to a version later than 20260610.

Exploit

Fix

Weakness Enumeration

CWE-804

Related Identifiers

CVE-2026-49953

Affected Products

Discuzx

References · 5

• 🔥 https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-49953 · Security Note
• https://karmainsecurity.com/KIS-2026-10 · Note
• https://vulncheck.com/advisories/discuz-x5-0-captcha-bypass-via-predictable-character-set · Note
• https://t.me/CVEtracker/56888 · Telegram Post