CVE-2026-49953

Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://karmainsecurity.com/KIS-2026-10
https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce
https://www.vulncheck.com/advisories/discuz-x5-0-captcha-bypass-via-predictable-character-set
http://seclists.org/fulldisclosure/2026/Jun/4

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Discuz! X5.0 versiones 20260320 hasta 20260610 contiene una vulnerabilidad de omisión de CAPTCHA que permite a atacantes remotos no autenticados eludir los controles de desafío explotando la complejidad limitada y los conjuntos de caracteres predecibles en las imágenes CAPTCHA generadas. Los atacantes pueden entrenar un modelo personalizado de reconocimiento óptico de caracteres contra muestras CAPTCHA recolectadas para predecir de forma fiable el texto del desafío, omitiendo las protecciones en el inicio de sesión, el registro y otras funcionalidades contra el abuso automatizado.

Information

Published : 2026-06-15 20:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-49953

Mitre link : CVE-2026-49953

CVE.ORG link : CVE-2026-49953

JSON object : View

Products Affected

No product.

CWE

CWE-804

Guessable CAPTCHA

{"id": "CVE-2026-49953", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49953", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T22:04:03.767762Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://gitee.com/Discuz/DiscuzX", "vendor": "Discuz!", "product": "Discuz! X5.0", "versions": [{"status": "affected", "version": "20260320", "versionType": "date", "lessThanOrEqual": "20260610"}], "defaultStatus": "unknown"}]}], "published": "2026-06-15T20:16:29.260", "references": [{"url": "https://karmainsecurity.com/KIS-2026-10", "source": "disclosure@vulncheck.com"}, {"url": "https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/discuz-x5-0-captcha-bypass-via-predictable-character-set", "source": "disclosure@vulncheck.com"}, {"url": "http://seclists.org/fulldisclosure/2026/Jun/4", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-804"}]}], "descriptions": [{"lang": "en", "value": "Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse."}, {"lang": "es", "value": "Discuz! X5.0 versiones 20260320 hasta 20260610 contiene una vulnerabilidad de omisi\u00f3n de CAPTCHA que permite a atacantes remotos no autenticados eludir los controles de desaf\u00edo explotando la complejidad limitada y los conjuntos de caracteres predecibles en las im\u00e1genes CAPTCHA generadas. Los atacantes pueden entrenar un modelo personalizado de reconocimiento \u00f3ptico de caracteres contra muestras CAPTCHA recolectadas para predecir de forma fiable el texto del desaf\u00edo, omitiendo las protecciones en el inicio de sesi\u00f3n, el registro y otras funcionalidades contra el abuso automatizado."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "disclosure@vulncheck.com"}