CVE-2026-49952 affects Discuz! X5.0 releases from 20260320 through 20260501. The vulnerability is due to reuse of a nonce and key pair in encryption between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject payloads through the username parameter during login to exploit the encryption oracle in logging_ctl::logging_more(), obtaining a legitimately signed token. This token allows bypassing authorization controls for database export and import functions. Additionally, a race condition can be triggered to impersonate arbitrary users, escalating the impact of the authentication bypass.

Successful exploitation allows unauthenticated remote attackers to gain unauthorized access to sensitive database backup and restore functionality. This can lead to unauthorized data export and import, potentially compromising the integrity and confidentiality of the database. The ability to impersonate arbitrary users further increases the risk of privilege escalation and unauthorized actions within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to the vulnerable API endpoints and monitor for suspicious activity related to database backup and restore operations. Avoid exposing the dbbak.php interface publicly.