CVE-2026-49952: Discuz! X5.0 Auth Bypass Vulnerability

CVE-2026-49952 Overview

CVE-2026-49952 is a critical authentication bypass vulnerability in Discuz! X5.0 releases 20260320 through 20260501. The flaw arises from a shared cryptographic key between the UCenter integration and the database backup API exposed by dbbak.php. Unauthenticated remote attackers can inject a crafted payload through the username parameter during login to abuse an encryption oracle in logging_ctl::logging_more(). The oracle returns a legitimately signed token that bypasses authorization for database export and import operations. Attackers can additionally trigger a race condition to impersonate arbitrary users, enabling full compromise of forum data and account takeover.

Critical Impact
Unauthenticated attackers can export and import the entire Discuz! database and impersonate any user, leading to complete forum compromise.

Affected Products

Discuz! X5.0 release 20260320
Discuz! X5.0 releases between 20260320 and 20260501
Discuz! X5.0 release 20260501

Discovery Timeline

2026-06-15 - CVE-2026-49952 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49952

Vulnerability Analysis

The vulnerability is classified under [CWE-323] (Reusing a Nonce, Key Pair in Encryption). Discuz! X5.0 reuses the same cryptographic key across two distinct trust boundaries: the UCenter single sign-on integration and the database backup API in dbbak.php. This key reuse allows a token signed for one context to satisfy authorization checks in another.

The login flow passes the attacker-controlled username parameter into logging_ctl::logging_more(), where it is incorporated into encrypted log output. By controlling the plaintext input, attackers turn the logging routine into an encryption oracle that emits ciphertext signed with the shared key. The resulting token validates against dbbak.php, granting access to database export and import functions without authentication.

The attacker can then chain the primitive with a race condition during session establishment to assume the identity of any registered user, including administrators. Database import functionality further enables persistent backdooring of the application.

Root Cause

The root cause is the use of a single cryptographic key for unrelated subsystems combined with an attacker-influenced plaintext path. The logging_more() routine acts as an unintended oracle, producing valid signatures for arbitrary attacker inputs.

Attack Vector

Exploitation is performed over the network with no authentication or user interaction. An attacker submits a crafted username value to the login endpoint, captures the encrypted response, and replays the derived token against dbbak.php to invoke backup or restore actions. A concurrent request triggers the race condition required for arbitrary user impersonation. Technical analysis is available in the Karma Insecurity Bug Chaining Analysis and the VulnCheck Security Advisory.

Detection Methods for CVE-2026-49952

Indicators of Compromise

Unauthenticated HTTP requests to dbbak.php with valid signed tokens originating from external IP addresses.
Login attempts containing unusually long, structured, or binary-looking values in the username parameter.
Unexpected database export files (.sql, .zip) appearing in the Discuz! backup directory.
Multiple near-simultaneous authentication requests for the same user account, indicating a race condition attempt.

Detection Strategies

Inspect web server access logs for POST requests to dbbak.php lacking a corresponding authenticated administrative session.
Alert on anomalous parameter entropy in the username field on login endpoints to flag oracle abuse attempts.
Correlate login events with subsequent backup API invocations occurring within short time windows.

Monitoring Recommendations

Forward Discuz! application logs and web server logs to a centralized SIEM for cross-correlation of login and backup activity.
Monitor file system changes in the Discuz! data/backup/ directory and alert on new file creation.
Track outbound data transfers from the web server to detect exfiltration of exported database archives.

How to Mitigate CVE-2026-49952

Immediate Actions Required

Upgrade Discuz! X5.0 to the build containing the fix from the Gitee Commit Reference.
Restrict network access to dbbak.php to administrator IP ranges via web server or firewall rules.
Rotate all UCenter authentication keys and database backup credentials after patching.
Audit the data/backup/ directory and review recent login logs for evidence of exploitation.

Patch Information

The vendor patch is published in the upstream repository at the Gitee Commit Reference. The fix separates cryptographic key material between UCenter and the backup API and removes attacker-controlled input from the logging encryption path. Administrators should apply the upstream changes and verify that the shared key is no longer reused. Additional details are available in the Karma Insecurity Vulnerability ID KIS-2026-09 advisory and the Full Disclosure Mailing List Post.

Workarounds

Block external access to dbbak.php at the reverse proxy or web application firewall until the patch is applied.
Disable the database backup module if it is not required for operations.
Enforce IP allow-listing on the Discuz! administrator panel to limit exposure of related endpoints.

bash

# Configuration example: deny external access to dbbak.php in nginx
location ~* /admin\.php {
    allow 10.0.0.0/8;
    deny all;
}

location ~* dbbak\.php$ {
    allow 10.0.0.0/8;
    deny all;
    return 403;
}