Critical Authentication Bypass (CVE‑2026‑49952) in Discuz! X5.0 Lets Attackers Gain Admin Access
What Happened — Discuz! X5.0 (versions 20260320‑20260501) contains an authentication‑bypass flaw in dbbak.php. An attacker can reuse a token generated by the UC_KEY encryption oracle to obtain admin‑level privileges without valid credentials. The vulnerability is rated CVSS 9.1 and was patched in the 2026‑05‑10 release.
Why It Matters for Compliance & Audit Readiness
- The flaw illustrates a classic breakdown of SOC 2 CC6.1 – Logical Access Controls: an unauthenticated request can elevate privileges, undermining the “least‑privilege” principle.
- Continuous‑compliance programs must capture evidence that authentication mechanisms are tested after each code change and that token‑reuse checks are in place.
- Verisq’s SOC2 Access Controls capability provides automated control mapping and audit‑ready evidence of token‑validation logic, helping you demonstrate that access controls are both designed and operating effectively.
Who Is Affected — Web‑forum operators, community portals, and any organization that runs Discuz! X5.0 (primarily the TECH_SAAS sector).
Recommended Actions
- Apply the vendor‑supplied patch (2026‑05‑10 or later) immediately.
- Rotate all UC_KEY tokens and invalidate any existing session tokens.
- Conduct a focused SOC 2 access‑control test on authentication endpoints and document the results as audit evidence.
- Update internal access‑control policies to require token‑reuse detection and periodic credential‑strength reviews.
- Integrate continuous monitoring of authentication logs into your SOC 2 evidence collection pipeline.
Source: Exploit‑DB EID‑52621
Technical Notes — The bypass leverages an encryption oracle in dbbak.php that reveals a reusable authcode. Exploit scripts send a crafted payload to obtain the token, then call the backup API with operation=backup&appid=1 to gain admin rights. CVE‑2026‑49952, CVSS 9.1. No public data exfiltration reported, but the control gap enables full system compromise.