Discuz! X5.0 Cross-Context Token Reuse Leading to Unauth RCE (CVE-2026-49952)

Discuz! X5.0 (UC_KEY) Cross-Context Token Reuse Vulnerability Vulnerability Overview Software Link: https://www.discuz.vip Affected Versions: Version X5.0, release versions 20260320 through 20260501. Vulnerability Description: - The vulnerable code is located in the configuration file . - When Discuz! X5.0 is installed in "standalone mode" (i.e., with default settings), it initializes the encryption constant by directly copying the value of the global setting. - As a result, the same encryption key is shared across multiple unrelated application components, including the UCenter integration and the script exposed by the database backup/restore API. This breaks cryptographic isolation, allowing tokens generated in one context to be accepted as valid in another. - Specifically, the method is invoked during login requests. When the parameter is present, it encrypts attacker-controlled input using the global setting and reflects the resulting ciphertext back to the client, effectively acting as an encryption oracle. By injecting command payloads constructed via the parameter, an unauthenticated attacker can obtain a legally signed token, bypass authorization checks in , and gain unauthorized access to database export and import functions. - Note: By abusing the database export and import functions, an attacker may trigger a Race Condition, ultimately enabling impersonation of any user and bypassing authentication. This can be chained with other vulnerabilities (such as X5-2026-11) to achieve unauthorized remote code execution. Impact Scope Version X5.0, release versions 20260320 through 20260501. Remediation Upgrade to release version 20260510 or later. Disclosure Timeline [27/04/2026] - Contacted the vendor via private message on gitee.com; no response [27/04/2026] - Contacted the vendor via email at admin@discuz.vip and security@tencent.com; no response [07/05/2026] - Opened issue #LFLW on https://gitee.com/Discuz/DiscuzX [09/05/2026] - Shared vulnerability details in issue #LFLW [09/05/2026] - Vulnerability fixed in commit 9962dad52c4c699dabaf91ecd70377c680ff3c6 [10/05/2026] - Released new version (Discuz_X5.0_20260510) [09/06/2026] - Requested CVE identifier [09/06/2026] - CVE identifier assigned [13/06/2026] - Public disclosure at hackmeeting 0x1D [15/06/2026] - Published this advisory CVE Reference CVE-2026-49952 has been assigned to this vulnerability. Credits The vulnerability was discovered by Egidio Romano. POC Code https://karmainsecurity.com/pocs/discuz_rce.zip

Goal Reached Thanks to every supporter — we hit 100%!

Discuz! X5.0 Cross-Context Token Reuse Leading to Unauth RCE (CVE-2026-49952)