CVE-2026-49952

Name of the Vulnerable Software and Affected Versions Discuz! X5.0 versions 20260320 through 20260501

Description An authentication bypass allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality. This is possible due to a shared cryptographic key between UCenter integration and the database backup API exposed by the 'dbbak.php' endpoint. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in the logging more() function within logging ctl, enabling them to obtain a signed token. This token allows the bypass of authorization for database export and import operations, and a race condition can be triggered to impersonate arbitrary users.

Recommendations For versions 20260320 through 20260501, apply the available patch to resolve the issue.