Discuz! X5.0 releases 20260320 through 20260610 contain a CAPTCHA bypass vulnerability that permits unauthenticated remote attackers to defeat the CAPTCHA challenge controls by exploiting the limited complexity and predictable character set used to generate the CAPTCHA images. The flaw is a form of input validation weakness (CWE‑804) that enables attackers to train a custom optical character recognition model on collected CAPTCHA samples and reliably determine the correct challenge text, thereby bypassing protections on login, registration, and other functions that rely on CAPTCHA to mitigate automated abuse.

Discuz!: Discuz! X5.0, versions released between 20260320 and 20260610 are affected.

The CVSS score of 6.9 indicates a medium severity vulnerability with a potential for automated credential stuffing or bot attacks. The EPSS score is below 1 %, suggesting that exploitation is unlikely at present, but the vulnerability is not listed in CISA KEV. Attackers would likely leverage a network-based web attack vector, collecting CAPTCHA images from exposed pages and training an OCR model offline, before using the trained model to automate actions such as account creation or login attempts. If the CAPTCHA bypass is successful on a site with weak subsequent authentication measures, automated abuse could lead to account takeover, data exfiltration or other privileged operations.