Discuz! X5.0 - Authentication Bypass
CVE-2026-49952
Verified
Description
Discuz! X5.0 20260320 through 20260501 contains an authentication bypass caused by exploitation of a shared cryptographic key and encryption oracle in dbbak.php and logging_ctl::logging_more(), letting unauthenticated remote attackers access database backup and restore functions, exploit requires crafted payload injection via username parameter.
Severity
Critical
CVSS Score
9.1
Exploit Probability
5%
Affected Product
discuz_x
Published Date
July 28, 2026
Template Author
0x_akoko
CVE-2026-49952.yaml
9.1Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVE ID:
cve-2026-49952
CWE ID:
cwe-323
Remediation Steps
Update to a version later than 20260501 or latest available version.