CVE-2026-49953
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Discuz! X5.0 versions from 20260320 to 20260610 contain a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images.
Risk Assessment
Attackers can exploit this vulnerability to automate abuse of login, registration, and other functionalities, potentially leading to unauthorized access to the system.
Recommendation
It is recommended to update to the latest version of Discuz! X5.0 to mitigate this vulnerability and implement additional CAPTCHA security mechanisms.
Other vulnerabilities in Discuz! X5.0
See all- CVE-2026-49952Critical
Discuz! X5.0 versions from 20260320 to 20260501 contain an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality. By exploiting a shared cryptographic key, attackers can inject crafted payloads through the username parameter during login.
- CVE-2026-49954High
Discuz! X5.0 versions from 20260320 to 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences.
Original NVD description (English source)
Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.