CVE-2026-18722
Received Received - Intake

Authorization Bypass in DWSurvey Survey Handler

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulDB

Description
A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do of the component Survey Handler. The manipulation results in authorization bypass. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-18722
EUVD
EUVD-2026-52571

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
diaowen dwsurvey to 6.14.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18722 is an authorization bypass vulnerability in diaowen DWSurvey version 6.14.0 or earlier. The flaw exists in the DwDeisgnSurveyController.devSurvey function within the /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do endpoint. An attacker can exploit this to bypass authorization controls remotely.

Detection Guidance

This vulnerability involves an authorization bypass in DWSurvey up to version 6.14.0. To detect it, check for unauthorized access attempts to the /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do endpoint. Monitor logs for unusual survey-related API calls or requests to dev-survey.do without proper authentication. Ensure all instances of DWSurvey are updated beyond version 6.14.0.

Impact Analysis

This vulnerability allows remote attackers to bypass authentication and gain unauthorized access to survey data or administrative functions. If exploited, sensitive information could be exposed or manipulated. The public availability of the exploit increases the risk of real-world attacks.

Compliance Impact

This vulnerability allows unauthorized access to survey data due to an authorization bypass, which could lead to unauthorized data exposure or modification. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy) if sensitive information is involved.

Mitigation Strategies

Immediately update diaowen DWSurvey to the latest version beyond 6.14.0 if available. If no update exists, consider disabling the affected component /api/dwsurvey/app/v6/dw-design-survey/dev-survey.do or restricting access to it via network controls. Monitor for unusual survey-related API activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18722. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart