GCVE-1988-2026-0343
Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
EPSS
VEX
Title
[KIS-2026-10] Discuz! <= X5.0 OCR-based CAPTCHA Bypass Vulnerability
Summary
------------------------------------------------------
Discuz! <= X5.0 OCR-based CAPTCHA Bypass Vulnerability
------------------------------------------------------
[-] Software Link:
https://www.discuz.vip
[-] Affected Versions:
Version X5.0, releases 20260320 through 20260610.
Older X3.4 and X3.5 releases may be affected too.
[-] Vulnerability Description:
A security weakness in the CAPTCHA implementation of Discuz! allows
automated solving of CAPTCHA challenges through Optical Character
Recognition (OCR) techniques.
Due to the limited complexity and predictability of the generated CAPTCHA
images, an attacker can train a custom OCR model to reliably recognize the
challenge text, effectively bypassing a security control intended to
prevent automated abuse.
This issue may facilitate automated registration, login, credential
stuffing, and exploitation workflows that rely on CAPTCHA-protected
functionality.
[-] Proof of Concept:
https://karmainsecurity.com/pocs/discuz_captcha_bypass.zip
[-] Solution:
No official solution is currently available.
[-] Disclosure Timeline:
[27/04/2026] - Vendor contacted through private messages on gitee.com, no
response
[27/04/2026] - Vendor contacted via e-mail at admin () discuz vip and
security () tencent com, no response
[07/05/2026] - Opened issue IJLFUW on https://gitee.com/Discuz/DiscuzX
[09/05/2026] - Vulnerability details shared within issue IJLFUW
[09/05/2026] - Vendor replied "OCR-based CAPTCHA bypass is a well-known
issue"
[09/06/2026] - CVE identifier requested
[09/06/2026] - CVE identifier assigned
[13/06/2026] - Public disclosure at hackmeeting 0x1D
[15/06/2026] - Publication of this advisory
[-] CVE Reference:
CVE-2026-49953 has been assigned to this vulnerability.
[-] Credits:
Vulnerability discovered by Egidio Romano.
[-] Original Advisory:
https://karmainsecurity.com/KIS-2026-10
[-] Technical write-up:
https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
Relationships
analysis
GCVE-1988-2026-0343 (this record)
- related CVE-2026-49953
{
"containers": {
"cna": {
"affected": [
{
"product": "Discuz!",
"vendor": "Discuz!",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "------------------------------------------------------\nDiscuz! \u003c= X5.0 OCR-based CAPTCHA Bypass Vulnerability\n------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.discuz.vip\n\n\n[-] Affected Versions:\n\nVersion X5.0, releases 20260320 through 20260610.\nOlder X3.4 and X3.5 releases may be affected too.\n\n\n[-] Vulnerability Description:\n\nA security weakness in the CAPTCHA implementation of Discuz! allows\nautomated solving of CAPTCHA challenges through Optical Character\nRecognition (OCR) techniques.\n\nDue to the limited complexity and predictability of the generated CAPTCHA\nimages, an attacker can train a custom OCR model to reliably recognize the\nchallenge text, effectively bypassing a security control intended to\nprevent automated abuse.\n\nThis issue may facilitate automated registration, login, credential\nstuffing, and exploitation workflows that rely on CAPTCHA-protected\nfunctionality.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/discuz_captcha_bypass.zip\n\n\n[-] Solution:\n\nNo official solution is currently available.\n\n\n[-] Disclosure Timeline:\n\n[27/04/2026] - Vendor contacted through private messages on gitee.com, no\nresponse\n[27/04/2026] - Vendor contacted via e-mail at admin () discuz vip and\nsecurity () tencent com, no response\n[07/05/2026] - Opened issue IJLFUW on https://gitee.com/Discuz/DiscuzX\n[09/05/2026] - Vulnerability details shared within issue IJLFUW\n[09/05/2026] - Vendor replied \"OCR-based CAPTCHA bypass is a well-known\nissue\"\n[09/06/2026] - CVE identifier requested\n[09/06/2026] - CVE identifier assigned\n[13/06/2026] - Public disclosure at hackmeeting 0x1D\n[15/06/2026] - Publication of this advisory\n\n\n[-] CVE Reference:\n\nCVE-2026-49953 has been assigned to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-10\n\n\n[-] Technical write-up:\n\nhttps://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T07:55:56Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/4"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jun/4"
},
{
"url": "https://gitee.com/Discuz/DiscuzX"
},
{
"url": "https://karmainsecurity.com/KIS-2026-10"
},
{
"url": "https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce"
},
{
"url": "https://karmainsecurity.com/pocs/discuz_captcha_bypass.zip"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.discuz.vip"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jun/4"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-10] Discuz! \u003c= X5.0 OCR-based CAPTCHA Bypass Vulnerability",
"x_gcve": [
{
"recordType": "analysis",
"relationships": [
{
"destId": "CVE-2026-49953",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0343",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/4",
"automated": true,
"contentSha256": "b57995b4e4fcb3b47cfaaa54e95919ec1b6be8469ec3fe193c4cadad9c0315ab",
"evidenceScore": 9,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/4",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-06-15T18:43:10Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0343"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-11T07:55:56Z",
"dateUpdated": "2026-09-11T07:55:56Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0343"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…