CVE-2026-49953: Discuz! x5.0

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse.

Affected products

• Discuz! Discuz! x5.0: from 20260320, up to and including 20260610

Published 2026-06-15. Last modified 2026-06-17.