Attack Chain

1. An unauthenticated remote attacker identifies a Discuz! X5.0 instance (releases 20260320-20260501) vulnerable to CVE-2026-49952.
2. The attacker crafts a malicious payload and injects it into the username parameter during a login attempt to the Discuz! instance via a POST request to /member.php or similar login endpoint.
3. This crafted payload is processed by the logging_ctl::logging_more() function, which contains an encryption oracle due to a shared cryptographic key used by UCenter integration.
4. By exploiting this encryption oracle, the attacker obtains a legitimately signed authorization token that can bypass further access controls.
5. The attacker uses the forged token to send direct HTTP requests to the /dbbak.php endpoint, bypassing normal authentication and authorization checks.
6. Through the /dbbak.php interface, the attacker gains unauthorized access to initiate database export (backup) and import (restore) operations.
7. The attacker can additionally trigger a race condition during this process to impersonate arbitrary authenticated users within the Discuz! forum.
8. The final objective is unauthorized access to critical database functions, allowing for data theft, modification, or complete compromise of the forum's content and user data.

Impact

Successful exploitation of CVE-2026-49952 grants unauthenticated attackers full control over the Discuz! X5.0 application's database. This includes the ability to export all database contents, leading to mass data exfiltration of user information, private messages, and forum posts. Attackers could also import malicious data, deface the forum, or implant persistent backdoors. The ability to impersonate arbitrary users further exacerbates the risk, allowing attackers to perform actions as legitimate users, including administrative actions if an administrator account is impersonated. Organizations using affected Discuz! X5.0 versions face severe risks of data breach, reputational damage, and operational disruption.

Recommendation

• Patch CVE-2026-49952 immediately by upgrading Discuz! X5.0 to a version beyond 20260501 that includes the fix.
• Deploy the provided Sigma rules "Detects CVE-2026-49952 Exploitation - Malicious Username Injection Attempt" and "Detects CVE-2026-49952 Exploitation - Unauthorized dbbak.php Access" to your SIEM to detect exploitation attempts.
• Enable comprehensive webserver access logging to capture full HTTP request details (URI stem, query, method, user-agent) for your Discuz! instances to facilitate detection and forensics.