CVE-2026-49953 affects Discuz! X5.0 releases between 20260320 and 20260501. The vulnerability arises from the generation of CAPTCHA images with limited complexity and predictable character sets, enabling attackers to train optical character recognition models to bypass CAPTCHA challenges. This bypass can be exploited remotely without authentication to circumvent protections on login, registration, and other functionalities that rely on CAPTCHA to prevent automated abuse. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality and integrity, with limited impact on availability.

The vulnerability allows unauthenticated remote attackers to bypass CAPTCHA protections, potentially enabling automated abuse of login, registration, and other protected functionalities. This could lead to increased spam, brute force attempts, or other automated attacks that the CAPTCHA was designed to prevent. There is no indication of direct code execution or data compromise from this vulnerability alone.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing additional anti-automation controls such as rate limiting, multi-factor authentication, or alternative CAPTCHA mechanisms with higher complexity and unpredictability.