CVE-2026-49953 affects Discuz! X5.0 releases from 20260320 through 20260501. The vulnerability arises from the use of CAPTCHAs with limited complexity and predictable character sets, enabling attackers to train optical character recognition models to bypass CAPTCHA challenges. This bypass can be exploited remotely without authentication to circumvent protections on login, registration, and other functionalities that rely on CAPTCHA to prevent automated abuse. The CVSS 4.0 base score is 6.9, reflecting a medium severity with network attack vector, low attack complexity, and no required privileges or user interaction. No vendor advisory or patch information is currently provided.

The vulnerability allows unauthenticated remote attackers to bypass CAPTCHA protections by predicting the challenge text using trained OCR models. This can lead to automated abuse of login, registration, and other CAPTCHA-protected functionalities. While it does not directly lead to system compromise, it undermines a key anti-automation control, increasing the risk of credential stuffing, spam registrations, or other automated attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing alternative CAPTCHA mechanisms with higher complexity or multi-factor protections to reduce the risk of automated abuse. Monitor for updates from the vendor regarding official patches or mitigations.