Discuz X5.0 Database Backup API dbbak.php logging_more Username nonce re-use

Summaryinfo

A vulnerability, which was classified as critical, was found in Discuz X5.0. The impacted element is the function logging_ctl::logging_more of the file dbbak.php of the component Database Backup API. Such manipulation of the argument Username leads to nonce re-use. This vulnerability is traded as CVE-2026-49952. The attack may be launched remotely. There is no exploit available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability was found in Discuz X5.0 (affected version not known). It has been rated as critical. Affected by this issue is the function logging_ctl::logging_more of the file dbbak.php of the component Database Backup API. The manipulation of the argument username with an unknown input leads to a nonce re-use vulnerability. Using CWE to declare the problem leads to CWE-323. Nonces should be used for the present occasion and only once. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in logging_ctl::logging_more(), obtain a legitimately signed token, and use it to bypass authorization for database export and import operations, with the additional ability to trigger a race condition to impersonate arbitrary users.

The weakness was shared by Egidio Romano. The advisory is available at karmainsecurity.com. This vulnerability is handled as CVE-2026-49952 since 06/02/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1600.001 by the MITRE ATT&CK project.

By approaching the search of inurl:dbbak.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch 20260501 is able to eliminate this problem. The bugfix is ready for download at gitee.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Discuz

Name

• X5.0

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion