Read the docs
TI-2026-36795 Aliases CVE-2026-49952GHSA-mx47-h32c-x878

Discuz! X5.0 Authentication Bypass via dbbak.php Encryption Oracle

Priority HIGH 81CWE-323Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in logging_ctl::logging_more(), obtain a legitimately signed token, and use it to bypass authorization for database export and import operations, with the additional ability to trigger a race condition to impersonate arbitrary users.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.04717 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Discuz!Discuz! X5.020260320 – 20260501—No fix listedCNA
  • Discuz! X5.0 VendorDiscuz! Affected 20260320 – 20260501 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49952
  2. 2026-10-03 Alias added: GHSA-mx47-h32c-x878
  3. 2026-10-25 EPSS moved to the 90th–95th percentile

References

Exploit 1

Patch 1

Other 1

  • TI-2026-36797 Discuz! X5.0 Local File Inclusion via enable_disable.php Plugin Directory CVSS 4.0HIGH 8.6
  • TI-2026-36796 Discuz! X5.0 CAPTCHA Bypass via Predictable Character Set CVSS 4.0MEDIUM 6.9
  • TI-2024-20381 Reflected Cross-Site Scripting (XSS) vulnerability in Discuz! version X3.4 20220811… CVSS 3.1HIGH 7.1
  • TI-2022-22486 Cross site scripting (XSS) vulnerability in DiscuzX 3.4 allows attackers to execute… CVSS 3.1MEDIUM 6.1
  • TI-2018-03910 Discuz! DiscuzX X3.4 allows remote attackers to bypass intended access restrictions via… CVSS 3.0CRITICAL 9.8
  • TI-2018-03813 Discuz! DiscuzX X3.4 allows remote authenticated users to bypass intended… CVSS 3.0HIGH 8.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences