CVE-2026-49952

The record

Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in logging_ctl::logging_more(), obtain a legitimately signed token, and use it to bypass authorization for database export and import operations, with the additional ability to trigger a race condition to impersonate arbitrary users.

Affected packages

Related vulnerabilities

• CVE-2026-50577 ePA 3.x Integration implements the authorization workflow and writes Medical Information… CWE-323
• CVE-2026-17578 Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation… CWE-323
• CVE-2026-21383 Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping… CWE-323
• CVE-2026-56369 ImageMagick before 7.1.2-22 contains an information disclosure vulnerability in the… CWE-323
• CVE-2026-55967 AES-GCM encryption/decryption with extremely large cumulative single message sizes (>64… CWE-323
• CVE-2026-12205 Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to… CWE-323
• GHSA-qv2q-c278-pch5 ImageMagick: Information Disclosure in PasskeyEncipherImage via AES-CTR nonce reuse CWE-323
• CVE-2026-45028 Astro is a web framework. CWE-323