Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-49952 – Authentication Bypass – Discuz! X5.0 (releases 20260320 through 20260501)

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-49952 is a critical authentication bypass vulnerability in Discuz! X5.0 (releases 20260320 through 20260501), the most popular PHP-based internet forum platform in China. The flaw allows unauthenticated remote attackers to exploit a shared cryptographic key across unrelated application components to obtain a legitimately signed authorization token, granting unauthorized access to full database export and import operations. The vulnerability carries a CVSS 4.0 score of 9.3 (Critical) with high confidentiality and integrity impact.

Technical details

  • Root cause: The global application key ($_config['security']['authkey']) is reused as the cryptographic key for both UCenter integration and the database backup/restore API. The UC_KEY in /config/config_ucenter.php is assigned the same value as authkey, violating cryptographic isolation principles (CWE-323: Reusing a Nonce, Key Pair in Encryption).
  • Trigger condition: An attacker sends a crafted login request with a malicious payload injected into the username parameter, accompanied by the lssubmit parameter. This causes logging_ctl::logging_more() to act as an encryption oracle, encrypting the attacker-controlled input with authkey and returning a legitimately signed token.
  • Attack vector: The signed token is then presented to /api/db/dbbak.php, the database backup API endpoint reachable unauthenticated over HTTP/HTTPS. Authorization checks are bypassed, granting full database export and import access.
  • Race condition for user impersonation: During a database import, the common_member table is dropped and re-created sequentially. An attacker can exploit this transient state — where a user exists in UCenter but not yet in the primary table — to cause userlogin() to return status -1, triggering forged session token generation and enabling arbitrary user impersonation.
  • Escalation to RCE: When chained with a Local File Inclusion (LFI) vulnerability in /source/app/admin/child/plugins/enable_disable.php, an attacker who has obtained administrator access via the above chain can upload malicious PHP code disguised as an image and include it through path traversal to achieve remote code execution.
  • No authentication is required at any stage of the primary exploit chain.

Affected software

  • Discuz! X5.0, releases 20260320 through 20260501 (date-based versioning)
  • Standalone mode installations are confirmed vulnerable

Severity

| Standard | Score | Vector |
|—|—|—|
| CVSS 4.0 | 9.3 (Critical) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CVSS 3.1 | 9.1 (Critical) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |

Mitigation and recommended actions

  • Immediate: Upgrade to Discuz! X5.0 release 20260510 (Discuz_X5.0_20260510) or later, released by the vendor on May 10, 2026. The fix is available in the official Discuz! X repository on Gitee.
  • If patching is not immediately possible:
    • Restrict or block external network access to the /api/db/dbbak.php endpoint at the web server or WAF level.
    • Ensure the database backup/restore API is not reachable from untrusted networks.
    • Monitor server logs for unexpected requests to dbbak.php or anomalous login attempts with unusual username payloads.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge